Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Windows\UpdateOffice.exe
Malicious functions:
Creates and executes the following:
- %HOMEPATH%\PrintHood\UpdateOffice.exe
- %HOMEPATH%\Windows\UpdateOffice.exe
Executes the following:
- <SYSTEM32>\ping.exe 174.142.57.29
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\700.bat" "
Modifies file system :
Creates the following files:
- %HOMEPATH%\PrintHood\~6B2E3CcLG6wwsI5l8CIX.TMP
- %HOMEPATH%\PrintHood\n5dEuogiGT.PRI
- %HOMEPATH%\PrintHood\~yIykcMsDqUhCYXkr2k7D.TMP
- %HOMEPATH%\PrintHood\~AOtpdl9SgHZ6oO7PP7dN.TMP
- %HOMEPATH%\PrintHood\jAcDJOOWrb.PRI
- %HOMEPATH%\PrintHood\vVHaz0KEFx.PRI
- %HOMEPATH%\PrintHood\hFMCf6d2nn.PRI
- %HOMEPATH%\PrintHood\PjQapaIf3u.PRI
- %HOMEPATH%\PrintHood\NJW3xRLRe5.PRI
- %HOMEPATH%\PrintHood\~plYwlPs0kwLS5szKg57t.TMP
- %HOMEPATH%\PrintHood\~7BNWcgTDkGPqeQHrTePl.TMP
- %HOMEPATH%\PrintHood\~Thel3vHzLerLSjLiT2tt.TMP
- %HOMEPATH%\PrintHood\~Zkk6gX7ejsClhQNaEvRS.TMP
- %HOMEPATH%\PrintHood\~P6TecP6aNpu13BxE34jB.TMP
- %HOMEPATH%\PrintHood\~0m6atfrpUBQqtcZxPR6H.TMP
- %HOMEPATH%\PrintHood\~A2XZDdGJXiMQTdN9XgpE.TMP
- %HOMEPATH%\PrintHood\~2nc9zSSUBsrJvvJBHzO9.TMP
- %HOMEPATH%\PrintHood\~m1yfMthgQeZbVXUZHfuq.TMP
- %HOMEPATH%\PrintHood\~yXDqRGlzYL9S8X3h4jZ8.TMP
- %HOMEPATH%\PrintHood\Uw8rpSFbUr.PRI
- %HOMEPATH%\PrintHood\HWz70fQB4G.PRI
- %HOMEPATH%\PrintHood\quQD0BBAQu.PRI
- %HOMEPATH%\PrintHood\X9bV5lUsm3.PRI
- %HOMEPATH%\PrintHood\MjlJOMIuLI.PRI
- %HOMEPATH%\PrintHood\s7oMIArRle.PRI
- %HOMEPATH%\PrintHood\gAZtiZ81Fu.PRI
- %HOMEPATH%\PrintHood\4VsRlLwGah.PRI
- %HOMEPATH%\PrintHood\YO04vbbdR6.PRI
- %HOMEPATH%\PrintHood\gtNX1ThZQT.PRI
- %HOMEPATH%\PrintHood\4eQXM6uPsO.PRI
- %HOMEPATH%\PrintHood\2KiXsGQTaM.PRI
- %HOMEPATH%\PrintHood\2oknIvgETe.PRI
- %HOMEPATH%\PrintHood\g41TuqiHTu.PRI
- %HOMEPATH%\PrintHood\7nWQGBRnv1.PRI
- %HOMEPATH%\PrintHood\FNwjXatBxa.PRI
- %HOMEPATH%\PrintHood\Wma1dUvnzs.PRI
- %HOMEPATH%\PrintHood\PzRUcTG5zl.PRI
- %HOMEPATH%\PrintHood\jWrvFySEGm.PRI
- %HOMEPATH%\PrintHood\0dTMFllKW1.PRI
- %HOMEPATH%\PrintHood\~ZozFMFSZARAF6sym4aqw.TMP
- %HOMEPATH%\PrintHood\~7hYt0uLq8d5a7xI32EZn.TMP
- %HOMEPATH%\PrintHood\~BcEfjqOH0mxh8pYHE04i.TMP
- %HOMEPATH%\PrintHood\~syHUNK8Te3vsCRB0I7fe.TMP
- %HOMEPATH%\PrintHood\~G1VOQkyNeG34CXlNFoV7.TMP
- %HOMEPATH%\PrintHood\~XlKjmuR8Tkvel2iZPNSI.TMP
- %HOMEPATH%\PrintHood\~rQt4D1JM47TqF0sd6wzf.TMP
- %HOMEPATH%\PrintHood\~6IM4lvICIKNKXb99cjyH.TMP
- %HOMEPATH%\PrintHood\~EE3X10TL1QiBIUUOKTku.TMP
- %HOMEPATH%\PrintHood\~qZU77AKjIzJ7WNjo8uSD.TMP
- %HOMEPATH%\PrintHood\~pZoqKZcKl6DR2rJUdSZE.TMP
- %HOMEPATH%\PrintHood\~3wbRrmSFlISQUWrzHAKj.TMP
- %HOMEPATH%\PrintHood\~pEFEPoeGRad8LnA4dNT8.TMP
- %HOMEPATH%\PrintHood\~ztaUJSOqpSkdLwZvsDET.TMP
- %HOMEPATH%\PrintHood\~GNhVsI11NWL3hwH4emMr.TMP
- %HOMEPATH%\PrintHood\~NVNLGBjc1p4UQ1DcwDKD.TMP
- %HOMEPATH%\PrintHood\~mBXU5Y5MVbi8NBgLnobP.TMP
- %HOMEPATH%\PrintHood\~UtGhCojNjS6x1Ja5DBKl.TMP
- %HOMEPATH%\PrintHood\~iqUMEZIszzRd2rOv8xf1.TMP
- %HOMEPATH%\PrintHood\~XhYOB6oGI7OolDHLMlmq.TMP
- %HOMEPATH%\PrintHood\~pRVXwXD139pREU93y2iK.TMP
- %HOMEPATH%\PrintHood\~9aiRN6hJDcRMxwyCCrVl.TMP
- %HOMEPATH%\PrintHood\~JhFaCHA92BXx5kkGO74E.TMP
- %HOMEPATH%\PrintHood\~Tl79B4iMMPGPfz28DRCL.TMP
- %HOMEPATH%\PrintHood\~WgM8lR3MveLKNtc9KwPu.TMP
- %HOMEPATH%\PrintHood\~DHcl51fc8aTIVFutUbMZ.TMP
- %HOMEPATH%\PrintHood\~mkoPltqbd7ELJPReR6y5.TMP
- %HOMEPATH%\PrintHood\~aIzbZsNphjIB8YUzRPsr.TMP
- %HOMEPATH%\PrintHood\~FMZJCtdgIzIfBsAmB0nb.TMP
- %HOMEPATH%\PrintHood\~xzJyoXVYXU41lnH5lCMG.TMP
- %HOMEPATH%\PrintHood\~kAwK5oKbMLC8rYLmpo9l.TMP
- %HOMEPATH%\PrintHood\~UkZB2OK2Gc556YOZyEXw.TMP
- %HOMEPATH%\PrintHood\~wInRpfOL1DA4sc7FQDFI.TMP
- %HOMEPATH%\PrintHood\~3WTbOuz73bhEcrrbgI7e.TMP
- %HOMEPATH%\PrintHood\~XehxEVrdPOZEXFP6u08C.TMP
- %HOMEPATH%\PrintHood\~BirbAHe0whZHFxWEWjAl.TMP
- %HOMEPATH%\PrintHood\~ObKxrEoxdUz3Y9yjCTV1.TMP
- %HOMEPATH%\PrintHood\~jf2uA7czfIS0NCbN1oDZ.TMP
- %HOMEPATH%\PrintHood\~g63H2bVO0r59YmF1nRyK.TMP
- %HOMEPATH%\PrintHood\zghUAbasy8.PRI
- %HOMEPATH%\PrintHood\UtMxhhqtcM.dll
- %HOMEPATH%\PrintHood\eBjbpILSdJ.dll
- %HOMEPATH%\PrintHood\UNCOsptADW.dll
- %HOMEPATH%\PrintHood\hbyIVNs3hX.dll
- %HOMEPATH%\PrintHood\6czsta6x9x.dll
- %HOMEPATH%\PrintHood\vOSr2TTzwr.dll
- %HOMEPATH%\PrintHood\vgLZ57Z5em.dll
- %HOMEPATH%\PrintHood\mErZk2ANH4.dll
- %HOMEPATH%\PrintHood\4NOQOQStbh.dll
- %HOMEPATH%\PrintHood\yxKITOYHBc.dll
- %HOMEPATH%\PrintHood\06Z16gapli.dll
- %HOMEPATH%\PrintHood\Mo2H6VgYqL.dll
- %HOMEPATH%\PrintHood\nTYjmXMbEz.dll
- %HOMEPATH%\PrintHood\iurVrVrDzb.dll
- %HOMEPATH%\PrintHood\X4xCaEpTnu.dll
- %HOMEPATH%\PrintHood\31ZhGbL7oZ.dll
- %HOMEPATH%\PrintHood\TKXwWDedCl.dll
- %HOMEPATH%\PrintHood\i4FQ0XYkZd.dll
- %HOMEPATH%\PrintHood\ZEyosDRJo5.dll
- %HOMEPATH%\PrintHood\vymwu7IU9H.dll
- %HOMEPATH%\PrintHood\0njyIdgiMX.dll
- %HOMEPATH%\PrintHood\dcnuoeTkXU.dll
- %HOMEPATH%\PrintHood\StS6Jg6OTM.dll
- %HOMEPATH%\PrintHood\An6VmplWOP.dll
- %HOMEPATH%\PrintHood\aWrO1839Nx.dll
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
- %HOMEPATH%\PrintHood\K7dzkzahIm.dll
- %HOMEPATH%\Templates\nam.dll
- %HOMEPATH%\PrintHood\jQ9SQbs3VE.dll
- %HOMEPATH%\PrintHood\1YSMktZgBK.dll
- %HOMEPATH%\PrintHood\Ok4IUhe5Sy.dll
- %HOMEPATH%\PrintHood\euYQLORAUF.dll
- %HOMEPATH%\PrintHood\fDkQzFvUo6.dll
- %HOMEPATH%\PrintHood\reRK64bDN6.dll
- %HOMEPATH%\PrintHood\XlCTEHIZDl.dll
- %HOMEPATH%\PrintHood\eTutWJDcga.dll
- %HOMEPATH%\PrintHood\kJNYr63L8J.dll
- %HOMEPATH%\PrintHood\8EY20EOHhX.dll
- %HOMEPATH%\PrintHood\toGZ4n4Q8e.PRI
- %HOMEPATH%\PrintHood\ooeTamPZzJ.PRI
- %HOMEPATH%\PrintHood\ImgXDdMeaz.PRI
- %HOMEPATH%\PrintHood\XFJ5PpEcip.PRI
- %HOMEPATH%\PrintHood\y5QkBtJ5yn.PRI
- %HOMEPATH%\PrintHood\tdWPMy3Gv6.PRI
- %HOMEPATH%\PrintHood\1eC5yTNbdd.PRI
- %HOMEPATH%\PrintHood\zIhGTITYfo.PRI
- %HOMEPATH%\PrintHood\KHVvlVnE4S.PRI
- %HOMEPATH%\PrintHood\DCrSMuy0vp.PRI
- %HOMEPATH%\PrintHood\cXJiQYIn7S.PRI
- %HOMEPATH%\PrintHood\Kp4psFFjiO.PRI
- %HOMEPATH%\PrintHood\IZBAQJLjk0.PRI
- %HOMEPATH%\PrintHood\zzyj4nUJUR.PRI
- %HOMEPATH%\PrintHood\FfWZnCkQas.PRI
- %HOMEPATH%\PrintHood\E1xOwsiTHB.PRI
- %HOMEPATH%\PrintHood\LwPoRFffac.PRI
- %HOMEPATH%\PrintHood\mC1Ld0EaGI.PRI
- %HOMEPATH%\PrintHood\6jxXUkTioJ.PRI
- %HOMEPATH%\PrintHood\46mXBNdpIt.PRI
- %HOMEPATH%\PrintHood\QOBwwgT0X1.dll
- %HOMEPATH%\PrintHood\Y9Ar1fihAP.dll
- %HOMEPATH%\PrintHood\n0RQUMzxok.dll
- %HOMEPATH%\PrintHood\XhGa1z7JR0.dll
- %HOMEPATH%\PrintHood\18v3eYFVR4.dll
- %HOMEPATH%\PrintHood\PP7FU0uyYu.dll
- %HOMEPATH%\PrintHood\Ja2xFGtpMU.dll
- %HOMEPATH%\PrintHood\GKdxUIL9z9.dll
- %HOMEPATH%\PrintHood\zQAvQwrTkw.dll
- %HOMEPATH%\PrintHood\lF0ieUJvFs.dll
- %HOMEPATH%\PrintHood\CRiWpz2f7R.PRI
- %HOMEPATH%\PrintHood\lhcoWZqUzq.PRI
- %HOMEPATH%\PrintHood\Ta7iLgPBMg.PRI
- %HOMEPATH%\PrintHood\J3Gutz1mEA.PRI
- %HOMEPATH%\PrintHood\wqcrZ0696d.dll
- %HOMEPATH%\PrintHood\Mzb2EDCpzz.dll
- %HOMEPATH%\PrintHood\LasLldLwjt.dll
- %HOMEPATH%\PrintHood\8xSsJ3tVnL.dll
- %HOMEPATH%\PrintHood\ZZf1bdRCsP.dll
- %HOMEPATH%\PrintHood\~rg1H8xoCNBWutvW396ZM.TMP
- %HOMEPATH%\PrintHood\~aPufhRVzZzA7JYMEqOk1.TMP
- %HOMEPATH%\PrintHood\~43hwIBzg4uuY0p9skgTj.TMP
- %HOMEPATH%\PrintHood\~ocBdaKRiQOmKZAoFDOQV.TMP
- %HOMEPATH%\PrintHood\~GGPgAqdASQWrmoQ1Hybi.TMP
- %HOMEPATH%\PrintHood\~c9rB9crf064Ibd70noyN.TMP
- %HOMEPATH%\PrintHood\~iCo3dBUutSrfGQTCbvk6.TMP
- %HOMEPATH%\PrintHood\~IhGkT4mgQMmzrsxp149E.TMP
- %HOMEPATH%\PrintHood\~YkXbuHme0crY3wshX0mK.TMP
- %HOMEPATH%\PrintHood\~h7PoyR3We54auvHertMV.TMP
- %HOMEPATH%\PrintHood\~G3F1lqykwDYTAXTt7zEm.TMP
- %HOMEPATH%\PrintHood\~U5HpMdQVHmOc6QzUJSri.TMP
- %HOMEPATH%\PrintHood\~ODJj0QVFF0AzGSZorgpE.TMP
- %HOMEPATH%\PrintHood\~TLYrgKlmIgQkDdo9kN6s.TMP
- %HOMEPATH%\PrintHood\~SzFJxartQzwqwJJP4BMR.TMP
- %HOMEPATH%\PrintHood\~F01anBxGkGr5UJ3R4Ome.TMP
- %HOMEPATH%\PrintHood\~Xr2Vfrzv56xtVgfItGE5.TMP
- %HOMEPATH%\PrintHood\~9D2Q8EfmyNsJh5qP5uuh.TMP
- %HOMEPATH%\PrintHood\~hKCuHFYLyMCZ3eSKpSya.TMP
- %HOMEPATH%\PrintHood\~3SyWsdtre6DNeoFMKm2s.TMP
- %HOMEPATH%\PrintHood\~RwXK5oJHaOwhFNnusfGN.TMP
- %HOMEPATH%\PrintHood\~tjfar2zc31Rh4jtOBYot.TMP
- %HOMEPATH%\PrintHood\~nSkHj1uK4bXepqtUIff3.TMP
- %HOMEPATH%\PrintHood\~ISmAFAGhNfvHathnKyh0.TMP
- %HOMEPATH%\PrintHood\~S0BYxYUIGGr4fQcze67H.TMP
- %HOMEPATH%\PrintHood\~Sx7awQ8ZPx54kYrz6eit.TMP
- %HOMEPATH%\PrintHood\~XRKDFVvTIltlaZMElJLs.TMP
- %HOMEPATH%\PrintHood\~NWSUetCYohyeeZNrhlW6.TMP
- %HOMEPATH%\PrintHood\~fhw1QfpJtSmerR4f6NQX.TMP
- %HOMEPATH%\PrintHood\~vdVrgOVMUN0xFjwN3BYC.TMP
- %HOMEPATH%\PrintHood\~yjmgxtVkrnIM0C6wiTP6.TMP
- %HOMEPATH%\PrintHood\~EzFtnkyJB84feInSPQPh.TMP
- %HOMEPATH%\PrintHood\~z0T5No3LiWN1WywfVZto.TMP
- %HOMEPATH%\PrintHood\~Vq1P9AYQZII98xXQD6lW.TMP
- %HOMEPATH%\PrintHood\~ujmWBGKn39kHJEEnqSMj.TMP
- %HOMEPATH%\PrintHood\~0H3WvvxVHlvvuHaYczxm.TMP
- %HOMEPATH%\PrintHood\~CXtxK03c1uREiTx5tNha.TMP
- %HOMEPATH%\PrintHood\~5lHCXQ9U5lh068VjQJiq.TMP
- %HOMEPATH%\PrintHood\~E12ReOmP5l6jWfrUopGV.TMP
- %HOMEPATH%\PrintHood\~MQJoEKArc6spANcxHUxK.TMP
- %HOMEPATH%\PrintHood\~katrukGEApu0KYAFVf8k.TMP
- %HOMEPATH%\PrintHood\~bwYkS3eLmAjEYFWftgCl.TMP
- %HOMEPATH%\PrintHood\~6wJHzKQazNOdX5TVMrO1.TMP
- %HOMEPATH%\PrintHood\~OlVxOYcADiI0xqpeUnYj.TMP
- %HOMEPATH%\PrintHood\~wcSmCRqOlBMxihGPODDp.TMP
- %HOMEPATH%\PrintHood\~0FPAMXpOO2bGNqkK1wOq.TMP
- %HOMEPATH%\PrintHood\~ZYxCMXn5u49qGLCjYUDN.TMP
- %HOMEPATH%\PrintHood\~YW5jpZE8ZifeRr3bPKDi.TMP
- %HOMEPATH%\PrintHood\~J51Wqro63tn1ahrziyqw.TMP
- %HOMEPATH%\PrintHood\Motahare.txt
- %HOMEPATH%\PrintHood\<Virus name>.exe.txt
- %HOMEPATH%\PrintHood\Shenik.dll
- %HOMEPATH%\PrintHood\Sitikatik.dll
- %HOMEPATH%\PrintHood\<Virus name>.exe.pdf
- %HOMEPATH%\PrintHood\datikal.dll
- %HOMEPATH%\PrintHood\~kN2g8OqxRUEExeiknpNC.TMP
- %HOMEPATH%\PrintHood\UpdateOffice.exe
- %HOMEPATH%\PrintHood\700.bat
- %HOMEPATH%\PrintHood\~vvRgzJxtrgcst0lh1Gnz.TMP
- %HOMEPATH%\PrintHood\~vdoRUPiPl1aCLJgLSzyr.TMP
- %HOMEPATH%\PrintHood\~hnAiVp3QWderYkhwfc8c.TMP
- %HOMEPATH%\PrintHood\~MBU3l1VrPhtju0XagrYQ.TMP
- %HOMEPATH%\PrintHood\~HvIv0zKIequ18cpWKojk.TMP
- %HOMEPATH%\PrintHood\~4iYq8techMEeQ6DRLbFd.TMP
- %HOMEPATH%\PrintHood\~HH3g8aC30P8d4suy8HyK.TMP
- %HOMEPATH%\PrintHood\~SIyPozz18WrcmkS1XbJS.TMP
- %HOMEPATH%\PrintHood\~Nwwf5riLqdauHuEUi6Ts.TMP
- %HOMEPATH%\PrintHood\~P08gLrmgMKOmY88KFd13.TMP
- %HOMEPATH%\PrintHood\~UgcwHeMp6HYbEnnTXhF8.TMP
- %HOMEPATH%\PrintHood\~ijtSwkLGfzgULbHqmaEm.TMP
- %HOMEPATH%\PrintHood\~vdi9Y0UVygtJ2vQGBQS6.TMP
- %HOMEPATH%\PrintHood\~L838sxpbWsoFybEH907w.TMP
- %HOMEPATH%\PrintHood\~YbahL51XL4t54PBdT1iw.TMP
- %HOMEPATH%\PrintHood\~zbDTuJlBVee8pgvfoTDK.TMP
- %HOMEPATH%\PrintHood\~0zDov1Y1p4ImIbZLxLVJ.TMP
- %HOMEPATH%\PrintHood\~zx4jMJe8FXCO2YGuhKCk.TMP
- %HOMEPATH%\PrintHood\~tGwqTNFl6gklAFaTgnCB.TMP
- %HOMEPATH%\PrintHood\~aPtPC4q6YjwMJrNH9W9G.TMP
- %HOMEPATH%\PrintHood\~jBfwNNDYHvqJ6SMHUTy3.TMP
- %HOMEPATH%\PrintHood\~OoZHWm1AUkKdaV8ckpb4.TMP
- %HOMEPATH%\PrintHood\~qWBLHOnveEPfW3YoRsSL.TMP
- %HOMEPATH%\PrintHood\~xeZh7tlwGMh6ezCCTFSE.TMP
- %HOMEPATH%\PrintHood\~p2fstH0br44IhBjZoEtg.TMP
- %HOMEPATH%\PrintHood\~ikDmB0fJVhEOExP2N8fK.TMP
- %HOMEPATH%\PrintHood\~rVKpWpuj6q3vf9ZEUNFe.TMP
- %HOMEPATH%\PrintHood\~2SnYzVyCWRUugAhB4Pqa.TMP
- %HOMEPATH%\PrintHood\~918PrrqbiC1qGGQYT99F.TMP
- %HOMEPATH%\PrintHood\~7dV55hH22mmCLP4KnJtf.TMP
- %HOMEPATH%\PrintHood\~3t0dyZSs5HaAMcvO0GEy.TMP
- %HOMEPATH%\PrintHood\~XkhNTfHGfTIbHamI3MSc.TMP
- %HOMEPATH%\PrintHood\~cEapS45dgdBWybIhHSVR.TMP
- %HOMEPATH%\PrintHood\~FoR63lBbWbvWaJfP4OiX.TMP
- %HOMEPATH%\PrintHood\~cjYMvyvJMin06JgotF6N.TMP
- %HOMEPATH%\PrintHood\~ux9oyfcR6MZjPvDHByxz.TMP
- %HOMEPATH%\PrintHood\~TbcMDIfQTY7vYsbvLjDn.TMP
- %HOMEPATH%\PrintHood\~V3vF6xRX2P3dQNXHS4yX.TMP
- %HOMEPATH%\PrintHood\~5IrGKQ6aGBjn2bMDUxNj.TMP
- %HOMEPATH%\PrintHood\~IwMpA8KvY9zsq35rZuqO.TMP
- %HOMEPATH%\PrintHood\~YBA2E9eERTdguisUy4sF.TMP
- %HOMEPATH%\PrintHood\~SgnMSxFZd0e6PNG9GlJJ.TMP
- %HOMEPATH%\PrintHood\~YBTrgBMHxY8yLY48LCDP.TMP
- %HOMEPATH%\PrintHood\~BD0AvQVvzV5h7yTbhWON.TMP
- %HOMEPATH%\PrintHood\~2p6YJOdeij8majOocp5J.TMP
- %HOMEPATH%\PrintHood\~BYZ6wyAN0W5QgQGFUrK2.TMP
- %HOMEPATH%\PrintHood\~MMTHyC063DwqvU3NFlWb.TMP
- %HOMEPATH%\PrintHood\~q8EKoiIukrvSZDnqHXRm.TMP
- %HOMEPATH%\PrintHood\~2kwuWa7Kr32eBZlnMh65.TMP
- %HOMEPATH%\PrintHood\~htYzuszC09hpfhdbd3yN.TMP
- %HOMEPATH%\PrintHood\~XHD8XR4pXGyXPIwxMtuv.TMP
- %HOMEPATH%\PrintHood\~5NcQmCpNUcWEWjvV5Fal.TMP
- %HOMEPATH%\PrintHood\~kSlasPmwVIxPoTHGAiiw.TMP
- %HOMEPATH%\PrintHood\~MmiRJQ6IwfZv3qDKL3l1.TMP
- %HOMEPATH%\PrintHood\~0vwQzDx125sba1ADXbgX.TMP
- %HOMEPATH%\PrintHood\~3Zk5lLfGdWjhQXF5Lv9W.TMP
- %HOMEPATH%\PrintHood\~q7OOk7Zpx3ZmAO3xYlkA.TMP
- %HOMEPATH%\PrintHood\~9JxAWcewLSg7M1KUIuZQ.TMP
- %HOMEPATH%\PrintHood\~a6SQyyhF6kf0z7pLscmp.TMP
- %HOMEPATH%\PrintHood\~gtZS7PhXxuZ5NDYyWD7y.TMP
- %HOMEPATH%\PrintHood\~McRRQy5Z90Zom8gSXcU5.TMP
- %HOMEPATH%\PrintHood\~E4fBhG8hPUpr6gzQWwAG.TMP
- %HOMEPATH%\PrintHood\~P230wKb45h7ze4IEXqLM.TMP
- %HOMEPATH%\PrintHood\~hR7D9y4MrqEB4wX12QmK.TMP
- %HOMEPATH%\PrintHood\~3vycw216c3SjEW1zfP80.TMP
- %HOMEPATH%\PrintHood\~G9cETqXpcKhyYRd2iZWl.TMP
- %HOMEPATH%\PrintHood\~T7rP2JuCNb7XHk83BImT.TMP
- %HOMEPATH%\PrintHood\~OpLOb9rbgmQPTV3SglwL.TMP
- %HOMEPATH%\PrintHood\~rQ5ftunOMexApfSb9NDi.TMP
- %HOMEPATH%\PrintHood\~ktqyfu27xnyfjtcaGEWq.TMP
- %HOMEPATH%\PrintHood\~IbNCajvqZYUBaChiiuQK.TMP
- %HOMEPATH%\PrintHood\~IU85WTIX6BF2v7zPeTT2.TMP
- %HOMEPATH%\PrintHood\~PYy32lcmqb5qIXWHY2j9.TMP
- %HOMEPATH%\PrintHood\~YsVHcBf25QBWqp2mIVmV.TMP
- %HOMEPATH%\PrintHood\~zJm3dWnXoISHJT9B3uip.TMP
- %HOMEPATH%\PrintHood\~DrpEyBwT4HWcqZ5FV08h.TMP
- %HOMEPATH%\PrintHood\~h8Dq34wESJy1mNwixTH4.TMP
- %HOMEPATH%\PrintHood\~sOnWjAL9LbuBKuPi7nKy.TMP
- %HOMEPATH%\PrintHood\~sPuKlPNyxGSsNeqKnsqJ.TMP
- %HOMEPATH%\PrintHood\~dZnVlpzcHFEkSl2rMb1l.TMP
- %HOMEPATH%\PrintHood\~UQtAU3ADcndi6QAwIjW9.TMP
- %HOMEPATH%\PrintHood\~aj3FpTP5AljbPt2IRuG8.TMP
- %HOMEPATH%\PrintHood\~exc3q2kw0Gwk1YL6mFZ0.TMP
- %HOMEPATH%\PrintHood\~SU3dK9Nqi0EeqH96P3Tv.TMP
- %HOMEPATH%\PrintHood\~IIpAgBR2YIJT7qhTcIIl.TMP
- %HOMEPATH%\PrintHood\~rF9IBvkDCzF7eApuP3HJ.TMP
- %HOMEPATH%\PrintHood\~doaCOLmIXPILRwgNnVXu.TMP
- %HOMEPATH%\PrintHood\~KMka5yNrABjdvjM2AWe1.TMP
- %HOMEPATH%\PrintHood\~8o5U4SVz6BoutVKat03G.TMP
- %HOMEPATH%\PrintHood\~xl0ndG4Vl3WbmNfJfyGc.TMP
- %HOMEPATH%\PrintHood\~PAavPNIFYZvswqR63stE.TMP
- %HOMEPATH%\PrintHood\~uaJKh0taL5y6FSgtLLEY.TMP
- %HOMEPATH%\PrintHood\~enO2hgrtFStqoXeyUAAb.TMP
- %HOMEPATH%\PrintHood\~FD9AJCCFpaj3qKrwE33f.TMP
- %HOMEPATH%\PrintHood\~Ikumeqj4xHypNlxyGWi2.TMP
- %HOMEPATH%\PrintHood\~QlCh2iklTMdCXMCmNIWW.TMP
- %HOMEPATH%\PrintHood\~sAASuuc2oVGWWXhdzevb.TMP
- %HOMEPATH%\PrintHood\~zymcqZUxPjq0hIWL8ONz.TMP
- %HOMEPATH%\PrintHood\~D1DYKq1B0nYPlftpe6my.TMP
Deletes the following files:
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\PrintHood\<Virus name>.exe.txt
Network activity:
Connects to:
- 'localhost':1039
- 'localhost':1040
- 'localhost':1038
- 'localhost':1036
- 'localhost':1037
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'http://174.142.57.29/ - 404 - File or directory not found. - Windows Internet Explorer'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: '404 - File or directory not found. - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'http://174.142.57.29/ - 404 - File or directory not found. - Microsoft Internet Explorer'
- ClassName: '' WindowName: '404 - File or directory not found. - Windows Internet Explorer'
- ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'http://174.142.57.29/ - u!u!u!u! - Windows Internet Explorer'
- ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'http://174.142.57.29/ - u!u!u!u! - Microsoft Internet Explorer'
