Gen.Variant.Kazy.1750_04ce170af0 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:740
cscript.exe:664
cscript.exe:1200
cscript.exe:1908
cscript.exe:1312
cscript.exe:1812
cscript.exe:1852
cscript.exe:1380
cscript.exe:1520
cscript.exe:424
cscript.exe:500
cscript.exe:1244
cscript.exe:1172
cscript.exe:1792
cscript.exe:676
cscript.exe:440
cscript.exe:460
cscript.exe:1356
cscript.exe:900
cscript.exe:1824
cscript.exe:1628
cscript.exe:1604
cscript.exe:472
cscript.exe:1672
cscript.exe:920
cscript.exe:2008
cscript.exe:1004
cscript.exe:432
cscript.exe:1416
cscript.exe:1512
%original file name%.exe:1300
%original file name%.exe:1124
%original file name%.exe:608
%original file name%.exe:1088
%original file name%.exe:1876
%original file name%.exe:1908
%original file name%.exe:496
%original file name%.exe:1420
%original file name%.exe:1540
%original file name%.exe:1852
%original file name%.exe:1072
%original file name%.exe:1196
%original file name%.exe:544
%original file name%.exe:1756
%original file name%.exe:812
%original file name%.exe:1400
%original file name%.exe:424
%original file name%.exe:1236
%original file name%.exe:896
%original file name%.exe:1792
%original file name%.exe:440
%original file name%.exe:1932
%original file name%.exe:1596
%original file name%.exe:168
%original file name%.exe:1264
%original file name%.exe:852
%original file name%.exe:2028
%original file name%.exe:1456
%original file name%.exe:532
%original file name%.exe:432
%original file name%.exe:680

The Trojan injects its code into the following process(es):

rSwooYMM.exe:1496
jWcYYUcg.exe:1552
FeEQMIQs.exe:1504

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1300 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iyIwkIwU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vIQIgwAc.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iyIwkIwU.bat (0 bytes)

The process %original file name%.exe:1124 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BEkUIAEc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AMYAAcgg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XSQwAIYw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mmUgUkcA.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (20 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AMYAAcgg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mmUgUkcA.bat (0 bytes)

The process %original file name%.exe:608 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QUkowAcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WwggkUMg.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jKUUIMII.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\loQUUQEs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WwggkUMg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\loQUUQEs.bat (0 bytes)

The process %original file name%.exe:1088 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lWsMcscI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sAAMQkkI.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sAAMQkkI.bat (0 bytes)

The process %original file name%.exe:1876 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gqcUYAYI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZOAwAEos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nQgkUMsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OkEwMEUk.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (20 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gqcUYAYI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OkEwMEUk.bat (0 bytes)

The process %original file name%.exe:1908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EeUMUgkg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tYgIwgwE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tYgIwgwE.bat (0 bytes)

The process %original file name%.exe:496 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zqUkwUck.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tQQUEckw.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tQQUEckw.bat (0 bytes)

The process %original file name%.exe:1420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7833 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7905 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xooIEIok.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zQEcwEwg.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xooIEIok.bat (0 bytes)

The process %original file name%.exe:1540 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AGAIQwEM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nksMsoUE.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AGAIQwEM.bat (0 bytes)

The process %original file name%.exe:1852 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lCYMYkwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TWAIgYIc.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TWAIgYIc.bat (0 bytes)

The process %original file name%.exe:1072 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JgMUEQEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lmIsEAkI.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JgMUEQEw.bat (0 bytes)

The process %original file name%.exe:1196 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zoAcwEgc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UCUAQYco.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zoAcwEgc.bat (0 bytes)

The process %original file name%.exe:544 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XyskYkwI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FkIYEwUk.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FkIYEwUk.bat (0 bytes)

The process %original file name%.exe:1756 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RUkoAoMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lscEIgYY.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lscEIgYY.bat (0 bytes)

The process %original file name%.exe:812 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ruMYUsAM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TyQoMYEk.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TyQoMYEk.bat (0 bytes)

The process %original file name%.exe:1400 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IgQsIMso.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FyIkoAAs.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IgQsIMso.bat (0 bytes)

The process %original file name%.exe:424 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MqoYIcAk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vekUkUMs.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vekUkUMs.bat (0 bytes)

The process %original file name%.exe:1236 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EQYIgYQo.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DqMAkkQY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DqMAkkQY.bat (0 bytes)

The process %original file name%.exe:896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YmAUUosM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KkYUgwwM.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YmAUUosM.bat (0 bytes)

The process %original file name%.exe:1792 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qQUAIAAQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RmEwcoUY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YcsMoYgI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hQUQcgIo.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (20 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qQUAIAAQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YcsMoYgI.bat (0 bytes)

The process %original file name%.exe:440 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OMEoAAog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWUEwswQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ECUssEMM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pQwgEIgI.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (20 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OMEoAAog.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ECUssEMM.bat (0 bytes)

The process %original file name%.exe:1932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qywogkwo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fgMkIcgA.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fgMkIcgA.bat (0 bytes)

The process %original file name%.exe:1596 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wqEEoQkc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cogsQUMw.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wqEEoQkc.bat (0 bytes)

The process %original file name%.exe:168 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dWcoUskk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EIwUQkwo.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EIwUQkwo.bat (0 bytes)

The process %original file name%.exe:1264 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pCYIcEYo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fagUksIg.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fagUksIg.bat (0 bytes)

The process %original file name%.exe:2028 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xUwUoMsQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iWcYIEoc.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xUwUoMsQ.bat (0 bytes)

The process %original file name%.exe:1456 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XycYkkQc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OwAocwMY.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OwAocwMY.bat (0 bytes)

The process %original file name%.exe:532 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QwAAEYoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gWMQYMoU.bat (4 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gWMQYMoU.bat (0 bytes)

The process %original file name%.exe:432 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nesAQYMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eaUcMYoc.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nesAQYMs.bat (0 bytes)

The process %original file name%.exe:680 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ousQwswM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IsQYowUE.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ousQwswM.bat (0 bytes)

The process FeEQMIQs.exe:1504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)

Registry activity

The process cscript.exe:740 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 DD 6D F9 69 AF 92 22 68 12 20 FE 35 CC A3 BB"

The process cscript.exe:664 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 B0 42 58 A3 94 D4 84 3E 88 75 A8 AC F9 A1 91"

The process cscript.exe:1200 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 E1 55 06 DE 79 27 48 03 DD 1B 06 CC 9F B0 CA"

The process cscript.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 4E 19 84 7E B0 E3 BE AF 3E C2 6F 9A FD 4A D3"

The process cscript.exe:1312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 67 AB 75 9C 35 C3 8E 30 52 3A 7E A6 45 E0 01"

The process cscript.exe:1812 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 07 CB 22 C2 D8 70 7D 79 93 A6 15 75 5D 18 1C"

The process cscript.exe:1852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 5E 56 A6 BC B9 4F F8 31 42 99 32 1A 32 AC A7"

The process cscript.exe:1380 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 26 E8 65 05 B3 C3 13 4A 27 2E 8F D3 99 81 F3"

The process cscript.exe:1520 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 00 FC 67 13 29 F5 65 73 AB A6 71 45 6C 86 A4"

The process cscript.exe:424 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 01 45 7E 6D C3 9D 56 1F 09 BB E9 C8 2E 69 84"

The process cscript.exe:500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 C3 B0 72 8B 60 63 D3 16 71 A0 90 66 2C EE 15"

The process cscript.exe:1244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 97 09 C7 DC 65 AF B8 60 16 56 8C 47 8A 62 E6"

The process cscript.exe:1172 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA C3 72 12 BB 82 52 66 8C 6D AB D1 F5 8E 5C AE"

The process cscript.exe:1792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 66 A6 8A 44 A0 56 5F E9 75 36 53 BD B2 69 C5"

The process cscript.exe:676 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 B8 BA ED 7D 42 9D 38 7C 1E C1 0F 63 EE 9A 79"

The process cscript.exe:440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 2E A9 3E 06 60 DC C7 07 B8 DA 40 A8 DB 0A 03"

The process cscript.exe:460 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 B1 1E 3E 1F D3 F5 3F CD 25 D9 D6 90 54 C7 B5"

The process cscript.exe:1356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 13 39 A8 83 98 A6 A7 86 25 D2 34 0B 5C 4D DD"

The process cscript.exe:900 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 0F 6A E3 76 33 AB A4 3B B1 EC 50 1B 91 EB B0"

The process cscript.exe:1824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 61 B0 22 9C 23 D3 EF 2F 3B 6F E1 82 44 0F 15"

The process cscript.exe:1628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 F7 A5 DB 14 93 19 F0 72 29 3E 12 9B D4 2A AE"

The process cscript.exe:1604 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E F4 7B 9B B4 1E EA F1 45 E5 41 9C F9 96 6D 1B"

The process cscript.exe:472 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 76 24 8B 0D 5E D0 8C A1 2F C0 C3 B6 59 5F 9E"

The process cscript.exe:1672 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 4C 9F 56 31 E1 AE AB 2F 8E 3C 0F 74 D1 DD E8"

The process cscript.exe:920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C C8 57 99 6C D9 D7 AC C3 A4 A7 B7 58 B4 F8 93"

The process cscript.exe:2008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C E3 4F 19 64 D2 E0 7B 00 74 67 A9 B8 BA 3A 9D"

The process cscript.exe:1004 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 F9 DB 7A B9 79 C9 20 03 21 2A 86 7E 04 40 54"

The process cscript.exe:432 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 C0 E9 2D 98 39 5F 29 33 87 8B B2 4B 24 1F D1"

The process cscript.exe:1416 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 8A 9C 19 F9 EA C6 A2 33 03 B4 03 D5 0A 62 A5"

The process cscript.exe:1512 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 4C 2D 2B 0A E0 82 CA 03 0D C5 69 BD 3D 2C F2"

The process rSwooYMM.exe:1496 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F 1B E5 76 1D 05 DF A2 42 DE D9 09 5D 11 CB D3"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process %original file name%.exe:1300 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 F4 2A AA 7B D3 D5 E9 EA F2 AC BE E3 EF A1 B4"

The process %original file name%.exe:1124 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 67 0D D9 F7 F9 38 BC 38 D8 BD F1 09 41 08 EF"

The process %original file name%.exe:608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 61 55 2C 19 AA 09 10 D8 50 FF 36 EA 87 8D F3"

The process %original file name%.exe:1088 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B DE 5E F4 0E CC 53 F3 00 85 B0 F3 BF 90 0E 4A"

The process %original file name%.exe:1876 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 0E F3 48 34 6A 61 3F 6C F2 35 9B 3D 93 1A 99"

The process %original file name%.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 78 4B 04 13 3D 99 AF 3A 0C F5 5A 99 A1 57 2F"

The process %original file name%.exe:496 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F DA 06 F3 2B A9 BC E7 89 31 50 C0 A3 82 B0 C5"

The process %original file name%.exe:1420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 DC C3 78 CD 29 4B 5A 60 DD EC 38 28 00 2D 34"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process %original file name%.exe:1540 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 18 45 65 A3 BE E5 67 8E F3 01 7E EF 02 93 51"

The process %original file name%.exe:1852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F CD 7C EA 91 F7 0B 9B 5A 89 1D D2 57 EA 23 44"

The process %original file name%.exe:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 6D F5 AA FA ED 71 0B EF 87 A6 94 5A 00 63 62"

The process %original file name%.exe:1196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 6E 77 E4 77 0A 5A 77 C0 B4 DD 6D 81 DD 05 32"

The process %original file name%.exe:544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 5D 60 62 7A E7 AF AE 3D 61 F2 4C 0E E2 89 FC"

The process %original file name%.exe:1756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C 80 B4 1F 2E EA E4 43 DC B9 54 6C 21 29 AB E5"

The process %original file name%.exe:812 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C D4 3B C9 33 CF EA 24 83 B5 A4 2C 67 52 54 E3"

The process %original file name%.exe:1400 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E D7 61 09 D3 5C 77 89 9A F1 40 94 AD 61 A4 B2"

The process %original file name%.exe:424 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 60 AB 9C 6C 54 64 7B FA 0D 6D 50 0F A9 0A B6"

The process %original file name%.exe:1236 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 53 7B 62 DE BC FA 95 FB 94 4C C4 BB F4 8C F1"

The process %original file name%.exe:896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 09 BA 8E 3A 91 6B E9 3B 34 72 EA EE 96 17 8D"

The process %original file name%.exe:1792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 8E 2E F5 70 58 5E 00 76 98 20 C8 81 36 6E 4E"

The process %original file name%.exe:440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 F7 80 95 8D B7 1E A4 E9 90 5B FA C2 1A A8 C1"

The process %original file name%.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF 62 E5 BA CA 83 AC 82 62 3B 91 E3 D1 7B 20 A2"

The process %original file name%.exe:1596 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 A0 98 06 08 C2 61 FA A8 71 E7 F2 10 93 80 20"

The process %original file name%.exe:168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 01 07 00 55 50 3E 5C 98 20 CD DC DA AD 01 1B"

The process %original file name%.exe:1264 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 07 BA A1 08 2E BC 6B 0D 9B BC F8 69 41 EE 8E"

The process %original file name%.exe:852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 FC 23 80 2B AA E9 24 6B B3 5A CB F1 38 3A F2"

The process %original file name%.exe:2028 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 F5 6E 5A F0 47 00 F9 21 D6 A6 2E 06 69 C0 A4"

The process %original file name%.exe:1456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 2D 52 EC A7 8F 8B 10 DA 3A A8 62 5E 4C 20 94"

The process %original file name%.exe:532 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 4D D8 4A 15 7B E1 83 A9 E0 0C 36 C9 22 7D 1A"

The process %original file name%.exe:432 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 98 1A 72 B7 5F E6 18 E2 A0 72 E3 B4 59 DD D0"

The process %original file name%.exe:680 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 50 F7 B7 C3 D8 32 6D 60 FB 06 CE 33 B8 C1 D2"

The process jWcYYUcg.exe:1552 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F 45 6B 59 89 D8 B6 5D 96 C8 40 8D 62 1A 95 09"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The process FeEQMIQs.exe:1504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 0A 8C F4 2B CD B9 FD 99 8B 08 1B D5 EB 7A CD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

Dropped PE files

MD5	File path
c3db2f77831130275148a41fbd213768	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
2659b7523fcec715c859e00255f8e66e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
4d95fb5744c09309db8cc61b7567dd0d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
5938c22883999093db95cebf67be1791	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
fc8ca50bf4ba8129a6b5439fed3f5fe4	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
5972ac991727402dcd518c914ac39715	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
148fa273b46681036ccda5b5de50e7a3	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
a34238ef1d883b07aedcf3e749f26950	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
2f3217af6d87757ae9aea0a391528013	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
e4ffe5b27153510d248b479460e73334	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
6abb69b5ffe7c5a1bfafabae2ccfdb46	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
edbcb55e0d21b221c1e1d87dd883793d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
e453133aaa85e24076efb256fa3b09dc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
491b710d4ce0105094b6e3b8c902c37d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
a94d4070ebbd70ec1aa4c18217d7c885	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
7e7ef36abbb314a84286042789d1aa0b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
517de57baf4258d26a5761eb999766ea	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
deba324d4737eeb8f46259b33ae62790	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
bb3127106f494f8e1b6b8d9ba8fb79fa	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
b5f631e5a5dd9a35cb43245849ba97ed	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
56f296d2e32db3086911bd41ccf8b91b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
ff6abf059966ceef44b8c606526b5005	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
adf188fd38d4454cd3c64cd233aa7b4e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
fee631b38b35ddc141bcdd2a70f86fa9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
00c271497c7346c035d1a0256ddc96ed	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
ea947a9b9a88a12629bbdb98ff7d3391	c:\Documents and Settings\All Users\BOAMIgUE\jWcYYUcg.exe
c8d20586099b69bae714c95e53b5af2a	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
82f331995e28669f5f5172168ee43812	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
da60b7e6919d4b1334501c9ed56bf232	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
7d7bff732546b7fc99357f7abcb79782	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
71c86c5227d5cdc663fa419975e611d0	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
a633c6b257ec1f7ec0edfa8921cacb2b	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
0e036a3f7babcd889c71d1d6849dd374	c:\Documents and Settings\All Users\hUEQccwo\FeEQMIQs.exe
3951daccba16490ba96d08886644c76f	c:\Documents and Settings\"%CurrentUserName%"\NwIscAww\rSwooYMM.exe
dab60f37687424b3276bf7d142aac851	c:\Perl\eg\IEExamples\ie_animated.gif.exe
cf99b89e09571c89bcd32821585d04e1	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
0a54e74f465cfc3e34038af0b173631a	c:\Perl\eg\aspSamples\ASbanner.gif.exe
8687fc6b8f93b8bcd7ecc5d25afda7f5	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
5d814d4f2b55a3f7698274f041efd0a7	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
5e9640544d739ec3ff8731bd488370bc	c:\Perl\html\images\AS_logo.gif.exe
bd613f393067a091d07b23e31078d3b0	c:\Perl\html\images\PerlCritic_run.png.exe
228727ffebbfffcbb0ed9811a6c495a8	c:\Perl\html\images\aslogo.gif.exe
5a54df37165edcfde09dfb32b1028ae8	c:\Perl\html\images\ppm_gui.png.exe
334c8ed69dc1f5459055e5ea6f85d9a5	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
c4be1c9a10bfd35446481a4ab9b01bb0	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
19fc5ac243c39a52a55cd9d1770236e4	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
7081fea967875418e224088f6ce638b4	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
99ceef80b7da548963665919180141f4	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
9c013247849a96cad315036d291ef530	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
e9584dea87b802b3fcd35379be1f17ae	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
217e01c667efc929b2734f3cfe064b91	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
502785af6b1a64ccf8178aeebd5baec2	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
f26a379ea8bf2975923c7d024571c768	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
cscript.exe:740
cscript.exe:664
cscript.exe:1200
cscript.exe:1908
cscript.exe:1312
cscript.exe:1812
cscript.exe:1852
cscript.exe:1380
cscript.exe:1520
cscript.exe:424
cscript.exe:500
cscript.exe:1244
cscript.exe:1172
cscript.exe:1792
cscript.exe:676
cscript.exe:440
cscript.exe:460
cscript.exe:1356
cscript.exe:900
cscript.exe:1824
cscript.exe:1628
cscript.exe:1604
cscript.exe:472
cscript.exe:1672
cscript.exe:920
cscript.exe:2008
cscript.exe:1004
cscript.exe:432
cscript.exe:1416
cscript.exe:1512
%original file name%.exe:1300
%original file name%.exe:1124
%original file name%.exe:608
%original file name%.exe:1088
%original file name%.exe:1876
%original file name%.exe:1908
%original file name%.exe:496
%original file name%.exe:1420
%original file name%.exe:1540
%original file name%.exe:1852
%original file name%.exe:1072
%original file name%.exe:1196
%original file name%.exe:544
%original file name%.exe:1756
%original file name%.exe:812
%original file name%.exe:1400
%original file name%.exe:424
%original file name%.exe:1236
%original file name%.exe:896
%original file name%.exe:1792
%original file name%.exe:440
%original file name%.exe:1932
%original file name%.exe:1596
%original file name%.exe:168
%original file name%.exe:1264
%original file name%.exe:852
%original file name%.exe:2028
%original file name%.exe:1456
%original file name%.exe:532
%original file name%.exe:432
%original file name%.exe:680
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\iyIwkIwU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vIQIgwAc.bat (112 bytes)
C:\04ce170af0fede545e5f8e95628a8c5b (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEkUIAEc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AMYAAcgg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XSQwAIYw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mmUgUkcA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QUkowAcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WwggkUMg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jKUUIMII.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\loQUUQEs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lWsMcscI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sAAMQkkI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gqcUYAYI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZOAwAEos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nQgkUMsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OkEwMEUk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EeUMUgkg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tYgIwgwE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zqUkwUck.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tQQUEckw.bat (4 bytes)
%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7833 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7905 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xooIEIok.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zQEcwEwg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AGAIQwEM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nksMsoUE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lCYMYkwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TWAIgYIc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JgMUEQEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lmIsEAkI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zoAcwEgc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UCUAQYco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XyskYkwI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FkIYEwUk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RUkoAoMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lscEIgYY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ruMYUsAM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TyQoMYEk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IgQsIMso.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FyIkoAAs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MqoYIcAk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vekUkUMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EQYIgYQo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DqMAkkQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YmAUUosM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KkYUgwwM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qQUAIAAQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RmEwcoUY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YcsMoYgI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hQUQcgIo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OMEoAAog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWUEwswQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ECUssEMM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pQwgEIgI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qywogkwo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fgMkIcgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wqEEoQkc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cogsQUMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dWcoUskk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EIwUQkwo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pCYIcEYo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fagUksIg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xUwUoMsQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iWcYIEoc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XycYkkQc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OwAocwMY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QwAAEYoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gWMQYMoU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nesAQYMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eaUcMYoc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ousQwswM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IsQYowUE.bat (112 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1003520	1000448	5.44919	f2d073e6158a05dc3d57f689cb3a099f
.rdata	1007616	4096	512	1.34429	37f8f484fc12ab39b472bd63b0b74c66
.data	1011712	5	512	0.067931	0bddccc57b9f1498692d29b6ce5a29d7
.rsrc	1015808	1372	1536	2.01749	16a989de7240a388a61c004fb16b8566

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	173.194.112.66

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=gYEZVfuEJeaG8Qe0woGwAw

Content-Length: 262

Date: Mon, 30 Mar 2015 17:01:53 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=gYEZVfuEJeaG8Qe0woGwAw">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=gYEZVcuBJeaG8Qe0woGwAw

Content-Length: 262

Date: Mon, 30 Mar 2015 17:01:53 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=gYEZVcuBJeaG8Qe0woGwAw">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

rSwooYMM.exe_1496:

.text

.rdata

@.data

b5.ug

.hFgU

.oe`"

t!.lN-=

t&t%xG

TcPoopUk

') 2ÃŸ

.xXlT '

A%fSx01/

-.xOf(

.Gr6nGTny

/T%x8f3x\

-Ã•O3C]i5

.lUnl

dxGjY4%x(

mNUk.xG

.Gm@tt

dFX.xG

C%uYlI

&%6XG

.Vk\.

k.qNk

%XmTgX

> %XUPC,i

'.Tf-

%X]Q|

.TV]S

rP[.wO

h`2%f%

fR[.wO

.FtjhY

S[.wg

.am$%

fR[.wN

v[[.wI

,[.wG

Uk!F%SEQF

4[.ww

.Al|3

x.pzNbR

fR[.wI

u[[.wI

E8[.wc

]%Cs,

fR[.wH

S[.wl

S[.wu

S[.wx

r/%u.

vQ[.wO

L.WZyu

L[.wl

p[.wu

b.Gr,.

L[.wz

S[.wz

f.KpV

D[.wu

w\[.wL

,[.ws

g%fxM1

,[.wt

fR[.wD

wS[.wJ

ZbXBSsh

|[.wv

P[.wH

U[.wI

wR[.wq

vQ[.wJ

fR[.wL

vV[.wI

-3%x(

l[.wc

|[.wq

cX.SA

*`.VR

S[.wv

,[.wv

R[.wO

L[.wN

e#.TP

,[.wz

Af%d

Q[.wH

wP[.ww

Z[.wy

L[.wv

S[.wp

uY[.wO

5"%xdF

w\[.wy

nP.BE

%co ,

2#C

iTCpb

l[.wv

.cqdT

4[.wc

H'%Uzo}m

&T.cp

b{y.xGy

v[[.wH

.Nfe`

wP[.wz

ht%F:jT

n\[.wy

tQ[.wH

,[.wb

{.lng

w\[.ww

6[.wt

,[.wl

3]9%UA{

,[.wu

p[[.wF

v4[.wG

pKt[.wK

p[.wp

5.fz%

V[.wH

l[.wq

sQ[.wH

w\[.wz

P[.wv

~j-2}|

T=.je2

;bG.YY|

fR[.wE

rU[.wG

/O[.wK

vL[.wG

e\[.wG

\[.wG

WwP[.wp

v".bBal

6.oHB

Microsoft Windows

1t%UF

ntdll.dll

user32.dll

kernel32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global III is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

rSwooYMM.exe_1496_rwx_009A0000_00001000:

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

FeEQMIQs.exe_1504:

.text

.rdata

@.data

b5.ug

.hFgU

.oe`"

t!.lN-=

t&t%xG

TcPoopUk

') 2ÃŸ

.xXlT '

A%fSx01/

-.xOf(

.Gr6nGTny

/T%x8f3x\

-Ã•O3C]i5

.lUnl

dxGjY4%x(

mNUk.xG

.Gm@tt

dFX.xG

C%uYlI

&%6XG

.Vk\.

k.qNk

%XmTgX

> %XUPC,i

'.Tf-

%X]Q|

.TV]S

rP[.wO

h`2%f%

fR[.wO

.FtjhY

S[.wg

.am$%

fR[.wN

v[[.wI

,[.wG

Uk!F%SEQF

4[.ww

.Al|3

x.pzNbR

fR[.wI

u[[.wI

E8[.wc

]%Cs,

fR[.wH

S[.wl

S[.wu

S[.wx

r/%u.

vQ[.wO

L.WZyu

L[.wl

p[.wu

b.Gr,.

L[.wz

S[.wz

f.KpV

D[.wu

w\[.wL

,[.ws

g%fxM1

,[.wt

fR[.wD

wS[.wJ

ZbXBSsh

|[.wv

P[.wH

U[.wI

wR[.wq

vQ[.wJ

fR[.wL

vV[.wI

-3%x(

l[.wc

|[.wq

cX.SA

*`.VR

S[.wv

,[.wv

R[.wO

L[.wN

e#.TP

,[.wz

Af%d

Q[.wH

wP[.ww

Z[.wy

L[.wv

S[.wp

uY[.wO

5"%xdF

w\[.wy

nP.BE

%co ,

2#C

iTCpb

l[.wv

.cqdT

4[.wc

H'%Uzo}m

&T.cp

b{y.xGy

v[[.wH

.Nfe`

wP[.wz

ht%F:jT

n\[.wy

tQ[.wH

,[.wb

{.lng

w\[.ww

6[.wt

,[.wl

3]9%UA{

,[.wu

p[[.wF

v4[.wG

pKt[.wK

p[.wp

5.fz%

V[.wH

l[.wq

sQ[.wH

w\[.wz

P[.wv

~j-2}|

T=.je2

;bG.YY|

fR[.wE

rU[.wG

/O[.wK

vL[.wG

e\[.wG

\[.wG

WwP[.wp

v".bBal

Microsoft Windows

84_>44 Ã‘

c40U.Sc

.kdSc

%F_Sc

*F%Sc

kOS.Sc

.XNHSc

Y.ZRc

Dz%SD

oleaut32.dll

advapi32.dll

shell32.dll