Gen.Variant.Kazy.1750_7569b2e8ce – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.1750 (B) (Emsisoft), Gen:Variant.Kazy.1750 (AdAware), Bancos.YR, ZeroAccess.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 7569b2e8cedfb8d810460a668b5df149

SHA1: 07c487be6ba0beb1e7252243c756d585f0611dc5

SHA256: c56764be977eaefafbd415fcd3c42ade9c7e316d2a539193fdfc8db62ca9b133

SSDeep: 24576:nZEPJT 5utxDb5DpA/WiFAFovClro8WRI7:nZE5 5utxXA/iZrxaI7

Size: 1004032 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-02-07 11:53:36

Analyzed on: WindowsXP SP3 32-bit

Summary: Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:668
cscript.exe:608
cscript.exe:1876
cscript.exe:272
cscript.exe:252
cscript.exe:1420
cscript.exe:1092
cscript.exe:1612
cscript.exe:524
cscript.exe:1176
cscript.exe:1652
cscript.exe:1756
cscript.exe:1316
cscript.exe:1172
cscript.exe:896
cscript.exe:1200
cscript.exe:164
cscript.exe:1884
cscript.exe:900
cscript.exe:1640
cscript.exe:536
cscript.exe:1388
cscript.exe:352
cscript.exe:436
cscript.exe:1572
cscript.exe:516
%original file name%.exe:768
%original file name%.exe:744
%original file name%.exe:1324
%original file name%.exe:1780
%original file name%.exe:468
%original file name%.exe:1420
%original file name%.exe:896
%original file name%.exe:1636
%original file name%.exe:1240
%original file name%.exe:1072
%original file name%.exe:956
%original file name%.exe:524
%original file name%.exe:320
%original file name%.exe:1520
%original file name%.exe:1756
%original file name%.exe:424
%original file name%.exe:1176
%original file name%.exe:1096
%original file name%.exe:448
%original file name%.exe:756
%original file name%.exe:1232
%original file name%.exe:1276
%original file name%.exe:260
%original file name%.exe:1144
%original file name%.exe:868
%original file name%.exe:1432
%original file name%.exe:1188
%original file name%.exe:1728
%original file name%.exe:1604
%original file name%.exe:1680
%original file name%.exe:1388
%original file name%.exe:684

The Trojan injects its code into the following process(es):

rSwooYMM.exe:1776
jWcYYUcg.exe:1644
FeEQMIQs.exe:1084
FeEQMIQs.exe:1380

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process rSwooYMM.exe:1776 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
\\STORAGE2\PIPE\srvsvc (72 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)

The process %original file name%.exe:744 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bqMIoQQc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UocEQUQA.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bqMIoQQc.bat (0 bytes)

The process %original file name%.exe:1324 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iuMQsYsE.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WgoAIQAY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WgoAIQAY.bat (0 bytes)

The process %original file name%.exe:1780 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YcAQMYsQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fuMMokUM.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YcAQMYsQ.bat (0 bytes)

The process %original file name%.exe:468 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kAIUsUAU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IuscokQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cioskoQY.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\usYIoYUw.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IuscokQk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\usYIoYUw.bat (0 bytes)

The process %original file name%.exe:1420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uIcwoIwA.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qqAEcEUA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uIcwoIwA.bat (0 bytes)

The process %original file name%.exe:896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AUkAAYIw.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sawAQEEo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AUkAAYIw.bat (0 bytes)

The process %original file name%.exe:1636 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xukcQUoE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sIsQIIoE.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sIsQIIoE.bat (0 bytes)

The process %original file name%.exe:1240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LSYIMcsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UEIcYskk.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UEIcYskk.bat (0 bytes)

The process %original file name%.exe:1072 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rOMwcUoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PsIswscE.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PsIswscE.bat (0 bytes)

The process %original file name%.exe:956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OEcwUYIw.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEkksgcA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OEcwUYIw.bat (0 bytes)

The process %original file name%.exe:524 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dQogcEoM.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YAkYokws.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YAkYokws.bat (0 bytes)

The process %original file name%.exe:320 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gkgIQwUw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yiIQIUwo.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gkgIQwUw.bat (0 bytes)

The process %original file name%.exe:1520 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\smkIkoog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUUgMcIA.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\smkIkoog.bat (0 bytes)

The process %original file name%.exe:1756 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vEIQssEM.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xuQwwgwU.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xuQwwgwU.bat (0 bytes)

The process %original file name%.exe:424 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GaMIgkIw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HWYYIAAY.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HWYYIAAY.bat (0 bytes)

The process %original file name%.exe:1176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fEccwIYI.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aSUMAgoY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fEccwIYI.bat (0 bytes)

The process %original file name%.exe:1096 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IOQAYIQY.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZqIowIEo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZqIowIEo.bat (0 bytes)

The process %original file name%.exe:448 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BcUsoooc.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LowgcwUE.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BcUsoooc.bat (0 bytes)

The process %original file name%.exe:756 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\suogsIcU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yuYwsQEE.bat (112 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7857 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7857 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\suogsIcU.bat (0 bytes)

The process %original file name%.exe:1232 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gIAEocQY.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bCwYUYAE.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gIAEocQY.bat (0 bytes)

The process %original file name%.exe:1276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lEMsIQwk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KKsoskco.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KKsoskco.bat (0 bytes)

The process %original file name%.exe:260 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kusgQwAA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wqgcgIsw.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wqgcgIsw.bat (0 bytes)

The process %original file name%.exe:1144 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RuQwcgcA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pYMUckAE.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RuQwcgcA.bat (0 bytes)

The process %original file name%.exe:868 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oCQIAsEQ.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UsAcAMEo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oCQIAsEQ.bat (0 bytes)

The process %original file name%.exe:1432 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RmYsUIoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gIwIYkQA.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RmYsUIoY.bat (0 bytes)

The process %original file name%.exe:1188 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uWogMsQg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JSoYoMYw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uWogMsQg.bat (0 bytes)

The process %original file name%.exe:1728 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ywEIEssg.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VKUEQUQQ.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VKUEQUQQ.bat (0 bytes)

The process %original file name%.exe:1604 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\agIEIEIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\goQcAoco.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\agIEIEIw.bat (0 bytes)

The process %original file name%.exe:1680 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LgkcsYYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qEoUUoww.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LgkcsYYE.bat (0 bytes)

The process %original file name%.exe:1388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AcsQgwUk.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OuUsUUsM.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OuUsUUsM.bat (0 bytes)

The process %original file name%.exe:684 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EOckwEAM.bat (4 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IGgcAgMk.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EOckwEAM.bat (0 bytes)

Registry activity

The process cscript.exe:668 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 4E 1A D1 4B 47 22 82 2A 18 58 F3 13 E2 9A 49"

The process cscript.exe:608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E C5 03 06 CB 06 8A DE 9C 00 5D 9D DD F1 35 CD"

The process cscript.exe:1876 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 3C C3 C6 AD 9B 9F B2 7E 4F B2 B4 0D E2 54 6A"

The process cscript.exe:272 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 01 10 1D 8C 17 40 A0 ED 97 EC C8 27 79 18 85"

The process cscript.exe:252 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F E9 8D E9 35 BB 6B DA 3A CC 65 4B D8 8D A9 36"

The process cscript.exe:1420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 35 B6 6E E8 F8 D2 1F 43 CC 1E 65 69 5F 63 AF"

The process cscript.exe:1092 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 69 C5 20 F8 20 FD 94 02 1E FC 4B 28 E6 E2 A3"

The process cscript.exe:1612 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D 82 7F F4 D8 61 65 13 72 23 81 6C 2D C7 C5 04"

The process cscript.exe:524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 08 12 05 29 60 5A CD 23 E5 8F 13 B6 1C AF DC"

The process cscript.exe:1176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 BE 23 CA F4 6E E2 97 0A 46 BE F3 F5 0A 1F AD"

The process cscript.exe:1652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 A6 F0 BB 93 18 CD C8 4C CA 21 15 43 85 F6 14"

The process cscript.exe:1756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 C8 37 02 F9 8F FE 5C 52 0E 27 63 FA A1 0A 45"

The process cscript.exe:1316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 14 7F 51 45 82 4E 9C FE 4B 95 0F BD 98 79 EC"

The process cscript.exe:1172 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 9B EE 94 23 47 21 49 CD BF 19 10 DA C8 35 FE"

The process cscript.exe:896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD 84 05 CD 96 85 2B FE AC 83 01 3B 2D B9 F1 80"

The process cscript.exe:1200 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE 2C A6 A9 59 0E 2A 1A AC 37 EE 02 8B A1 6D 19"

The process cscript.exe:164 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 6C A6 5F E6 1D 30 2C 56 FE 63 22 0B 24 DC 72"

The process cscript.exe:1884 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 F2 D0 00 6E 4B 40 C5 3B B5 81 9C 82 C6 71 9E"

The process cscript.exe:900 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 74 16 D2 2A 54 A8 2D 5A 7E F1 1B 9F 5F 87 82"

The process cscript.exe:1640 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 CC 88 20 0B E5 61 CF F2 45 67 A3 67 EE 95 07"

The process cscript.exe:536 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 CE 09 C4 86 0B FE 5D 0C DE 3E F4 47 72 6C 14"

The process cscript.exe:1388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 56 15 E3 4B 49 0D 4B 71 7E 3F 6E B5 D4 90 A6"

The process cscript.exe:352 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D C2 C5 99 FC FF 6D 43 EB 70 2E A9 53 44 DC 66"

The process cscript.exe:436 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 89 85 FE 43 CE 94 46 60 08 E9 EE 54 79 A1 57"

The process cscript.exe:1572 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C 31 6F EF 68 35 65 91 DA 49 D8 9C 63 56 AA 68"

The process cscript.exe:516 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 8A EF 54 82 A7 84 F3 41 F2 75 EE 1E 7D A2 B8"

The process rSwooYMM.exe:1776 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 DF 81 B8 A7 F0 B2 DC 86 31 54 89 65 17 4D 91"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process %original file name%.exe:768 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 08 B9 BA 8E 24 82 1C AC 36 48 CE 41 55 EC D0"

The process %original file name%.exe:744 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 AE A2 1C D8 C3 82 64 1D C2 6F 5B 51 95 46 1E"

The process %original file name%.exe:1324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 CD 0A 9A A7 FA B9 6E 84 F9 DC 5D 96 88 FB 4B"

The process %original file name%.exe:1780 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 C9 44 17 4F 38 C5 8E 2D 48 8C 3B 1B 9E 74 57"

The process %original file name%.exe:468 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB B8 60 46 B7 1B 31 CD DA 0E 6E FF 2E B4 B8 4D"

The process %original file name%.exe:1420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 6E EF 5D 0E 68 7F B8 D4 08 F5 C1 7B AC 95 CD"

The process %original file name%.exe:896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D D5 E1 EC 2F 3A F5 96 52 21 6E C8 7D 19 20 70"

The process %original file name%.exe:1636 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F 2F C6 57 19 76 0B 73 62 E9 20 FD CE 7B 77 5D"

The process %original file name%.exe:1240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 2F 1D 07 C8 9F 92 67 CA 2F 8E 22 25 56 5E DB"

The process %original file name%.exe:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 E9 C6 1A 17 77 D3 DD 9F FE 87 A7 F7 E8 D8 39"

The process %original file name%.exe:956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 1A 7B D5 6E 79 3D F8 CF 17 07 5D B0 10 01 62"

The process %original file name%.exe:524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 8D 0E FF EA 5E F4 67 65 B2 D4 79 74 9C D9 C9"

The process %original file name%.exe:320 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 96 E0 5E 8D D7 AC 46 53 D2 43 30 9E DF B9 3E"

The process %original file name%.exe:1520 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 4E E1 CB 4C 38 A2 D1 80 EC 68 B5 D6 32 29 4B"

The process %original file name%.exe:1756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 FD 7B 10 1B A1 54 53 61 20 1B B7 67 41 89 EE"

The process %original file name%.exe:424 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 51 FA 87 18 B4 D8 55 FB E3 A2 C1 4D 93 65 DC"

The process %original file name%.exe:1176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 33 C1 60 57 78 A8 AD 9D DE FB 05 B7 C1 6D F2"

The process %original file name%.exe:1096 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 59 86 70 3A FB 4E 36 18 60 DA 5F 3E 56 EB 4E"

The process %original file name%.exe:448 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 81 DD 70 0B EF 89 E9 DF 00 CE 0A 7C D9 21 27"

The process %original file name%.exe:756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C CD C6 F8 E4 8E 44 2E FA CF 36 0C 1E 3E B6 1E"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process %original file name%.exe:1232 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 DF 1C 53 0C F9 37 3B 11 ED 8B 27 CD 4B 59 90"

The process %original file name%.exe:1276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 F4 DC 0A 3D 8D 71 3A 1E E3 4F 1E 10 CA EE 73"

The process %original file name%.exe:260 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 5D D7 B0 2B 21 69 F0 9B 7C 68 B4 C6 DE CA 6D"

The process %original file name%.exe:1144 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 A3 EC A7 25 2A E7 88 6B D6 E9 08 29 55 81 03"

The process %original file name%.exe:868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 CF E6 1C DD 8B 47 95 E7 D9 64 19 F1 6F B2 43"

The process %original file name%.exe:1432 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 9B 44 8D B4 48 D7 B2 93 67 16 24 C7 99 DE 6B"

The process %original file name%.exe:1188 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 58 65 7C BA 1B DB 5B 1D 28 1C 8E 81 26 DE AB"

The process %original file name%.exe:1728 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 E4 FF 6E 53 11 11 8B FA A8 BF F2 57 6F A7 0C"

The process %original file name%.exe:1604 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 B0 9F 27 7A 79 63 D6 F6 8F 1A 51 00 DA 73 F4"

The process %original file name%.exe:1680 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 E4 4A 91 D7 68 29 77 90 81 BC DB 3B 2F D4 C9"

The process %original file name%.exe:1388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA D6 4E 53 F7 28 DB EB B0 2E 79 12 A2 01 E7 76"

The process %original file name%.exe:684 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B D8 BF 06 2A 14 1D E7 08 8A C3 76 71 47 FB EA"

The process jWcYYUcg.exe:1644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 2E 40 CA 24 70 2B 01 7A 83 7D C1 C4 4A 94 58"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The process FeEQMIQs.exe:1084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B A0 A5 BC 9B 1C 3E E9 30 33 92 44 5E 78 77 E8"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The process FeEQMIQs.exe:1380 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C 6B DA D1 AE B6 71 01 BA E5 C4 8F 86 87 03 AE"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

Dropped PE files

MD5	File path
a50e988d39c0b6cd05008bd66afd1e5b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
4b0c6c1d1bb64d33ac7a585212663c40	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
e7469ef682a35f5b48c87574064b6ffe	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
b122b3e0e6c8b41f0a27d6e36868cd03	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
dad0550193aef7c8cd6ae48de7ba85d5	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
8c7719cb84fef31aebc919345adc0a89	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
6d85e7d9e5b113658a90f7bcd14066ad	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
2a2e1d060a378dac51038679016810d7	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
5d802ad6365119f5b4f35ba716c39a39	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
c649165a09648fcd64aad472ade614a8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
34df31bedd0e352020264247533540a1	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
536b9f457d993ea4d852047a29fa0146	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
62e7839cf143ffd7415cf9377cd71d8c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
22b8266a7698ee2b41512f0c406e9454	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
beeb60bd1a1ee2a9edc79f83c5a3f33e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
70e0070bd515f116877850500248c415	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
975752b96cdbf40db91784a1d77f1f01	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
830c50306d6f52f702e0c6f350dc89fc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
bceb0bd5e21c95a399169ea223832ad2	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
e65ad72183508791f760581a416b40a6	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
2a4e9284003cda13fd53113579fd8a42	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
996cb07fa6a21d1fe741f4a3693a85be	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
09e79f0990303306ddba35ea358a0894	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
f0e69084f051a078f6d27dc1edc8ce7c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
dd4ee29fe8868c27d8f84b64960ac043	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
8a4327622214f36055226e4ae636af92	c:\Documents and Settings\All Users\BOAMIgUE\jWcYYUcg.exe
5d8a3918ff61470bf01567634ee054a7	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
57b773d05b437af21d31dc22741854f4	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
68ddf2a548ba4188108277a40a04b143	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
0691d1a6376abd43423a2e60d23a318f	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
ec44badd7f37e943e36b7d6c8153daeb	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
78d24d215ee01c30cc7b9a79481cb962	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
652fcc58eeb98f132fb6722fb770f878	c:\Documents and Settings\All Users\hUEQccwo\FeEQMIQs.exe
5b1133598cc688d0725d42056594dd3f	c:\Documents and Settings\"%CurrentUserName%"\NwIscAww\rSwooYMM.exe
0efded049f010c1696d80a3515a40b3f	c:\Perl\eg\IEExamples\ie_animated.gif.exe
9bc7c79917792f6769dcf4ada02b8987	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
a8540a13b69dfda4290aaf87cb489181	c:\Perl\eg\aspSamples\ASbanner.gif.exe
e243003f7317f1877b0856576cded7c3	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
ba3f872169c084db8bb86d108b3e13b7	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
13dc54e0828690b501948bfa18514198	c:\Perl\html\images\AS_logo.gif.exe
f47bb2b95b55b05a360ad203e24b321b	c:\Perl\html\images\PerlCritic_run.png.exe
5ddc208aee6031b1e4c6746faa55dec2	c:\Perl\html\images\aslogo.gif.exe
bc6f47ba4ad4e92717b40b716f96469d	c:\Perl\html\images\ppm_gui.png.exe
a2aece756851b9bb4ea3e912956d8e15	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
b36e4168c59e35b9f510c01073313d40	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
5fdba1d0d8e0a0b076200b8bbf94f59b	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
599ae500b173cc60b26856081209ccb6	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
ae9782805183ee3829df3e7291f89b36	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
12350a5ec4e8fe51ff42db44e1f2a06b	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
d8ff8021b3d51b6cedca51f97db36b0e	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
7ed3505387a7858f19cd725280f2a088	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
8d4105d506ab41e48d5c202af9cf4b88	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
1e28cefe96794244ac61e668878587f8	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
cscript.exe:668
cscript.exe:608
cscript.exe:1876
cscript.exe:272
cscript.exe:252
cscript.exe:1420
cscript.exe:1092
cscript.exe:1612
cscript.exe:524
cscript.exe:1176
cscript.exe:1652
cscript.exe:1756
cscript.exe:1316
cscript.exe:1172
cscript.exe:896
cscript.exe:1200
cscript.exe:164
cscript.exe:1884
cscript.exe:900
cscript.exe:1640
cscript.exe:536
cscript.exe:1388
cscript.exe:352
cscript.exe:436
cscript.exe:1572
cscript.exe:516
%original file name%.exe:768
%original file name%.exe:744
%original file name%.exe:1324
%original file name%.exe:1780
%original file name%.exe:468
%original file name%.exe:1420
%original file name%.exe:896
%original file name%.exe:1636
%original file name%.exe:1240
%original file name%.exe:1072
%original file name%.exe:956
%original file name%.exe:524
%original file name%.exe:320
%original file name%.exe:1520
%original file name%.exe:1756
%original file name%.exe:424
%original file name%.exe:1176
%original file name%.exe:1096
%original file name%.exe:448
%original file name%.exe:756
%original file name%.exe:1232
%original file name%.exe:1276
%original file name%.exe:260
%original file name%.exe:1144
%original file name%.exe:868
%original file name%.exe:1432
%original file name%.exe:1188
%original file name%.exe:1728
%original file name%.exe:1604
%original file name%.exe:1680
%original file name%.exe:1388
%original file name%.exe:684
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
\\STORAGE2\PIPE\srvsvc (72 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bqMIoQQc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UocEQUQA.bat (112 bytes)
C:\7569b2e8cedfb8d810460a668b5df149 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iuMQsYsE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WgoAIQAY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YcAQMYsQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fuMMokUM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kAIUsUAU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IuscokQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cioskoQY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\usYIoYUw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uIcwoIwA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qqAEcEUA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AUkAAYIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sawAQEEo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xukcQUoE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sIsQIIoE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LSYIMcsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UEIcYskk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rOMwcUoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PsIswscE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OEcwUYIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEkksgcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dQogcEoM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YAkYokws.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gkgIQwUw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yiIQIUwo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\smkIkoog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUUgMcIA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vEIQssEM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xuQwwgwU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GaMIgkIw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HWYYIAAY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fEccwIYI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aSUMAgoY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IOQAYIQY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZqIowIEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BcUsoooc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LowgcwUE.bat (112 bytes)
%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\suogsIcU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yuYwsQEE.bat (112 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7857 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gIAEocQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bCwYUYAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lEMsIQwk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KKsoskco.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kusgQwAA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wqgcgIsw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RuQwcgcA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pYMUckAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oCQIAsEQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UsAcAMEo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RmYsUIoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gIwIYkQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uWogMsQg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JSoYoMYw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ywEIEssg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VKUEQUQQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\agIEIEIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\goQcAoco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LgkcsYYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qEoUUoww.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AcsQgwUk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OuUsUUsM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EOckwEAM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IGgcAgMk.bat (112 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	999424	996864	5.45681	9561e4b68fb209385755462f7f74bb72
.rdata	1003520	4096	512	1.75274	a5c803c15ed1d02c963ba05f02f87af7
.data	1007616	4	512	0.056519	a095dcc266e21da8698dbd0926f6aa4c
.rsrc	1011712	4444	4608	2.91049	c5fa1e6bee5904c366781d3186913aee

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	173.194.112.78

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=mcMZVfKnMemG8QffnIGAAw

Content-Length: 262

Date: Mon, 30 Mar 2015 21:43:53 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=mcMZVfKnMemG8QffnIGAAw">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=k8MZVfnnJ-eG8Qe-z4DIDw

Content-Length: 262

Date: Mon, 30 Mar 2015 21:43:47 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=k8MZVfnnJ-eG8Qe-z4DIDw">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=l8MZVabjC-eG8Qe-z4DIDw

Content-Length: 262

Date: Mon, 30 Mar 2015 21:43:51 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=l8MZVabjC-eG8Qe-z4DIDw">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

rSwooYMM.exe_1776:

.text

.rdata

@.data

b5.ug

?iiUt.Ci

z0bu:%C

Xq*d.tG#

tG.sw

%uyIyt

}.Zz|

}.ncj

=%d\n

4.Imj y

@dUDp

.Xq.-

%xGw"

[.eRf,

]k.Ez

B.zeJ

G.mck

{M.mrdA

ÃŸ(

Sx%sJZu_

ima%XL

).RUZCE

.ZS]T

6{.lo

KQ%CV

Y).ok

/!FkEy

.Mlu*z

,Oy-X}&

.sWu5

r(%C:

.FeJb

v".bBal

Microsoft Windows

reg.exe

cedfb8d810460a668b5df149.exe

Jk` .Oh

ElfReportEventA

advapi32.dll

ntdll.dll

kernel32.dll

user32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global III is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

rSwooYMM.exe_1776_rwx_009A0000_00001000:

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

rSwooYMM.exe_1776_rwx_009F0000_00001000:

VwV.QWC

FeEQMIQs.exe_1380:

.text

.rdata

@.data

b5.ug

.hFgU

.oe`"

t!.lN-=

t&t%xG

TcPoopUk

') 2ÃŸ

.xXlT '

A%fSx01/

-.xOf(

.Gr6nGTny

/T%x8f3x\

-Ã•O3C]i5

.lUnl

dxGjY4%x(

mNUk.xG

.Gm@tt

dFX.xG

C%uYlI

&%6XG

.Vk\.

k.qNk

%XmTgX

> %XUPC,i

'.Tf-

%X]Q|

.TV]S

rP[.wO

h`2%f%

fR[.wO

.FtjhY

S[.wg

.am$%

fR[.wN

v[[.wI

,[.wG

Uk!F%SEQF

4[.ww

.Al|3

x.pzNbR

fR[.wI

u[[.wI

E8[.wc

]%Cs,

fR[.wH

S[.wl

S[.wu

S[.wx

r/%u.

vQ[.wO

L.WZyu

L[.wl

p[.wu

b.Gr,.

L[.wz

S[.wz

f.KpV

D[.wu

w\[.wL

,[.ws

g%fxM1

,[.wt

fR[.wD

wS[.wJ

ZbXBSsh

|[.wv

P[.wH

U[.wI

wR[.wq

vQ[.wJ

fR[.wL

vV[.wI

-3%x(

l[.wc

|[.wq

cX.SA

*`.VR

S[.wv

,[.wv

R[.wO

L[.wN

e#.TP

,[.wz

Af%d

Q[.wH

wP[.ww

Z[.wy

L[.wv

S[.wp

uY[.wO

5"%xdF

w\[.wy

nP.BE

%co ,

2#C

iTCpb

l[.wv

.cqdT

4[.wc

H'%Uzo}m

&T.cp

b{y.xGy

v[[.wH

.Nfe`

wP[.wz

ht%F:jT

n\[.wy

tQ[.wH

,[.wb

{.lng

w\[.ww

6[.wt

,[.wl

3]9%UA{

,[.wu

p[[.wF

v4[.wG

pKt[.wK

p[.wp

5.fz%

V[.wH

l[.wq

sQ[.wH

w\[.wz

P[.wv

~j-2}|

T=.je2

;bG.YY|

fR[.wE

rU[.wG

/O[.wK

vL[.wG

e\[.wG

\[.wG

WwP[.wp

v".bBal

Microsoft Windows

1t%UF

|].oj

oleaut32.dll

ntdll.dll

RegEnumKeyA