Gen.Variant.Kazy.535458_d4a55cc7b4 – Adaware

Gen:Variant.Kazy.535458 (B) (Emsisoft), Gen:Variant.Kazy.535458 (AdAware), ZeroAccess.YR (Lavasoft MAS)Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: d4a55cc7b461baa492d09def48760fb6

SHA1: 9e299ead1493fd92c710ac91f6749976d29b01a0

SHA256: 2c790a7829b5f3c3f27ed9d4daba7562c0889eef1303fb9c568d7af6b5f497eb

SSDeep: 12288:LTV JiEdghdusjrGSPl8xkXCb3GgiQvdvUEuXK8awp9st5IQxq2M:Pxpjr/DXQiQdUEcX2hM

Size: 625664 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-01-06 02:36:08

Analyzed on: WindowsXP SP3 32-bit

Summary: Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

%original file name%.exe:3076
%original file name%.exe:3928
%original file name%.exe:2184
%original file name%.exe:2656
%original file name%.exe:2840
%original file name%.exe:4024
%original file name%.exe:4092
%original file name%.exe:2320
%original file name%.exe:3552
%original file name%.exe:2484
%original file name%.exe:2480
%original file name%.exe:3792
%original file name%.exe:2120
%original file name%.exe:3852
%original file name%.exe:2400
%original file name%.exe:3996
%original file name%.exe:548
%original file name%.exe:1916
%original file name%.exe:348
%original file name%.exe:1460
%original file name%.exe:1672
%original file name%.exe:2912
%original file name%.exe:1792
%original file name%.exe:1796
%original file name%.exe:3644
%original file name%.exe:1068
%original file name%.exe:3564
%original file name%.exe:1824
%original file name%.exe:3568
%original file name%.exe:2996
%original file name%.exe:2496
%original file name%.exe:928
%original file name%.exe:2412
%original file name%.exe:2392
%original file name%.exe:828
%original file name%.exe:2256
%original file name%.exe:2796
%original file name%.exe:2252
%original file name%.exe:3772
%original file name%.exe:2900
%original file name%.exe:2472
%original file name%.exe:3628
%original file name%.exe:2772
%original file name%.exe:2776
%original file name%.exe:3140
%original file name%.exe:3272
%original file name%.exe:3148
%original file name%.exe:2308
%original file name%.exe:2540
%original file name%.exe:1716
%original file name%.exe:2980
%original file name%.exe:4048
%original file name%.exe:3388
%original file name%.exe:2176
%original file name%.exe:3160
%original file name%.exe:2076
%original file name%.exe:3580
%original file name%.exe:3956
%original file name%.exe:304
%original file name%.exe:3216
%original file name%.exe:2764
%original file name%.exe:380
%original file name%.exe:1932
%original file name%.exe:1776
%original file name%.exe:240
%original file name%.exe:388
%original file name%.exe:2836
%original file name%.exe:3508
%original file name%.exe:2276
%original file name%.exe:244
%original file name%.exe:2576
%original file name%.exe:1840
%original file name%.exe:3016
%original file name%.exe:2992
%original file name%.exe:3096
%original file name%.exe:644
%original file name%.exe:2676
%original file name%.exe:3188
%original file name%.exe:2372
%original file name%.exe:1224
%original file name%.exe:3124
%original file name%.exe:1228
%original file name%.exe:3696
%original file name%.exe:2800
%original file name%.exe:1900
%original file name%.exe:2880
%original file name%.exe:3368
%original file name%.exe:1980
%original file name%.exe:3692
%original file name%.exe:3360
%original file name%.exe:1988
%original file name%.exe:3088
%original file name%.exe:1032
%original file name%.exe:3084
%original file name%.exe:2360
%original file name%.exe:3600
%original file name%.exe:2152
%original file name%.exe:636
%original file name%.exe:2580
%original file name%.exe:2420
%original file name%.exe:464
%original file name%.exe:3892
%original file name%.exe:1596
%original file name%.exe:3520
%original file name%.exe:3288
%original file name%.exe:2188
%original file name%.exe:3280
%original file name%.exe:220
%original file name%.exe:3688
%original file name%.exe:3444
%original file name%.exe:3680
%original file name%.exe:1028
%original file name%.exe:2892
%original file name%.exe:3964
%original file name%.exe:3532
%original file name%.exe:816
%original file name%.exe:1452
%original file name%.exe:3116
%original file name%.exe:2100
%original file name%.exe:2692
%original file name%.exe:1108
%original file name%.exe:4080
%original file name%.exe:2736
%original file name%.exe:3868
%original file name%.exe:2868
%original file name%.exe:3632
%original file name%.exe:2436
%original file name%.exe:3460
%original file name%.exe:2816
%original file name%.exe:2948
%original file name%.exe:3068
%original file name%.exe:1052
%original file name%.exe:2944
%original file name%.exe:2340
%original file name%.exe:2228
%original file name%.exe:3196
%original file name%.exe:3432
%original file name%.exe:4004
%original file name%.exe:2348
%original file name%.exe:1196
%original file name%.exe:1568
%original file name%.exe:2036
%original file name%.exe:2672
%original file name%.exe:3480
%original file name%.exe:2748
%original file name%.exe:3812
%original file name%.exe:2500
%original file name%.exe:3916
%original file name%.exe:2724
%original file name%.exe:612
%original file name%.exe:1816
%original file name%.exe:1608
%original file name%.exe:3428
%original file name%.exe:3228
%original file name%.exe:1860
%original file name%.exe:1600
%original file name%.exe:940
%original file name%.exe:356
%original file name%.exe:2004
%original file name%.exe:3224
%original file name%.exe:2604
%original file name%.exe:3340
%original file name%.exe:804
cscript.exe:3920
cscript.exe:1300
cscript.exe:2848
cscript.exe:3712
cscript.exe:3228
cscript.exe:2304
cscript.exe:132
cscript.exe:2860
cscript.exe:3412
cscript.exe:3344
cscript.exe:2172
cscript.exe:3808
cscript.exe:2524
cscript.exe:1072
cscript.exe:2528
cscript.exe:344
cscript.exe:1376
cscript.exe:2244
cscript.exe:280
cscript.exe:548
cscript.exe:348
cscript.exe:3992
cscript.exe:2460
cscript.exe:1524
cscript.exe:2916
cscript.exe:3936
cscript.exe:1796
cscript.exe:1956
cscript.exe:3336
cscript.exe:3152
cscript.exe:1228
cscript.exe:3640
cscript.exe:2316
cscript.exe:2992
cscript.exe:1064
cscript.exe:2996
cscript.exe:3244
cscript.exe:2804
cscript.exe:2264
cscript.exe:2060
cscript.exe:3848
cscript.exe:2064
cscript.exe:2252
cscript.exe:2288
cscript.exe:2904
cscript.exe:3940
cscript.exe:1028
cscript.exe:2828
cscript.exe:3032
cscript.exe:3308
cscript.exe:1484
cscript.exe:3148
cscript.exe:4044
cscript.exe:2308
cscript.exe:3476
cscript.exe:3472
cscript.exe:2544
cscript.exe:2548
cscript.exe:2788
cscript.exe:1256
cscript.exe:2384
cscript.exe:368
cscript.exe:2072
cscript.exe:3108
cscript.exe:2668
cscript.exe:3844
cscript.exe:3812
cscript.exe:2280
cscript.exe:3956
cscript.exe:2764
cscript.exe:380
cscript.exe:244
cscript.exe:240
cscript.exe:3268
cscript.exe:2832
cscript.exe:3316
cscript.exe:3392
cscript.exe:2272
cscript.exe:3012
cscript.exe:3468
cscript.exe:2208
cscript.exe:644
cscript.exe:2792
cscript.exe:2376
cscript.exe:2928
cscript.exe:2596
cscript.exe:3596
cscript.exe:2592
cscript.exe:3804
cscript.exe:2456
cscript.exe:2452
cscript.exe:3004
cscript.exe:3000
cscript.exe:2196
cscript.exe:3900
cscript.exe:3164
cscript.exe:1900
cscript.exe:2200
cscript.exe:2880
cscript.exe:3368
cscript.exe:1980
cscript.exe:3364
cscript.exe:2560
cscript.exe:3696
cscript.exe:2368
cscript.exe:2684
cscript.exe:188
cscript.exe:2680
cscript.exe:2428
cscript.exe:3600
cscript.exe:2624
cscript.exe:3608
cscript.exe:3524
cscript.exe:3728
cscript.exe:3724
cscript.exe:2188
cscript.exe:220
cscript.exe:868
cscript.exe:3904
cscript.exe:3376
cscript.exe:3440
cscript.exe:3684
cscript.exe:3500
cscript.exe:3964
cscript.exe:2108
cscript.exe:2752
cscript.exe:2100
cscript.exe:1512
cscript.exe:740
cscript.exe:1160
cscript.exe:2436
cscript.exe:3324
cscript.exe:2632
cscript.exe:3672
cscript.exe:2948
cscript.exe:3736
cscript.exe:2344
cscript.exe:1052
cscript.exe:1968
cscript.exe:4000
cscript.exe:2224
cscript.exe:3436
cscript.exe:1568
cscript.exe:1112
cscript.exe:2500
cscript.exe:2648
cscript.exe:2724
cscript.exe:2644
cscript.exe:1276
cscript.exe:3484
cscript.exe:3352
cscript.exe:3056
cscript.exe:2132
cscript.exe:3052
cscript.exe:3780
cscript.exe:1040
cscript.exe:3540
cscript.exe:3380
cscript.exe:948
cscript.exe:4012
cscript.exe:3788
cscript.exe:804

The Malware injects its code into the following process(es):

fGAwoYMM.exe:1864
reIEcoQI.exe:232
NesIMIQs.exe:228

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3076 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AikAYYsE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EosMskMk.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AikAYYsE.bat (0 bytes)

The process %original file name%.exe:3928 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZyEgAEoE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XYwgogYI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XiEscooM.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fEIssgcU.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZyEgAEoE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XiEscooM.bat (0 bytes)

The process %original file name%.exe:2184 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cAkkgUUE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EegIIkAM.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EegIIkAM.bat (0 bytes)

The process %original file name%.exe:2656 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QCowssYQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZQcQcsMg.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QCowssYQ.bat (0 bytes)

The process %original file name%.exe:2840 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iigQokYY.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KeYQEIQA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iigQokYY.bat (0 bytes)

The process %original file name%.exe:4024 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xqsMAIQM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ocAAsUsQ.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xqsMAIQM.bat (0 bytes)

The process %original file name%.exe:4092 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uiswAccA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FyowAYIU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FyowAYIU.bat (0 bytes)

The process %original file name%.exe:2320 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eKAQckoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lsUYUoIM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uyoEIMoU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\huwEcEoU.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eKAQckoA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uyoEIMoU.bat (0 bytes)

The process %original file name%.exe:3552 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tQMsAcUs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fqMUsgso.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mskosYkY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DMMwAEck.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tQMsAcUs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fqMUsgso.bat (0 bytes)

The process %original file name%.exe:2484 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WockIEgs.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PMsUEkgA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WockIEgs.bat (0 bytes)

The process %original file name%.exe:2480 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LQQkEMwU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PyoUwIEM.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LQQkEMwU.bat (0 bytes)

The process %original file name%.exe:3792 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wYYMYUks.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uWwogccE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uWwogccE.bat (0 bytes)

The process %original file name%.exe:2120 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AKkIUoYc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vucYgcYk.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AKkIUoYc.bat (0 bytes)

The process %original file name%.exe:3852 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QaIUcAUs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LkEsggoM.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LkEsggoM.bat (0 bytes)

The process %original file name%.exe:2400 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rusAscwU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bwAMEsMM.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rusAscwU.bat (0 bytes)

The process %original file name%.exe:3996 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QosEYAco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SOwIEUsE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SOwIEUsE.bat (0 bytes)

The process %original file name%.exe:548 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kyUYYwoQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JKwIUoow.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kyUYYwoQ.bat (0 bytes)

The process %original file name%.exe:1916 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nyQUoEcY.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XEwcwMok.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nyQUoEcY.bat (0 bytes)

The process %original file name%.exe:348 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aGoUYMEw.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dIwoAwMk.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dIwoAwMk.bat (0 bytes)

The process %original file name%.exe:1460 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aIEUsUoo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XgkEoAAs.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UIoIMMkw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NIEUkEIA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XgkEoAAs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UIoIMMkw.bat (0 bytes)

The process %original file name%.exe:1672 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eOAEcIoQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oksIgYMU.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eOAEcIoQ.bat (0 bytes)

The process %original file name%.exe:2912 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MyUQoIAQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LUYIIcQw.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LUYIIcQw.bat (0 bytes)

The process %original file name%.exe:1792 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HYMkQgQI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BMgEYgUQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BMgEYgUQ.bat (0 bytes)

The process %original file name%.exe:1796 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oEkYUEEw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qCYIgMss.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cIUoMMwM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jWsksgII.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cIUoMMwM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jWsksgII.bat (0 bytes)

The process %original file name%.exe:3644 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rUoMYAwc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DskEMwcU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DskEMwcU.bat (0 bytes)

The process %original file name%.exe:1068 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FyEcwAgo.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lOkkQMMo.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lOkkQMMo.bat (0 bytes)

The process %original file name%.exe:3564 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OOskgIEQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hmUEwsUQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XikMAgEM.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\maEEAYAc.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hmUEwsUQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\maEEAYAc.bat (0 bytes)

The process %original file name%.exe:1824 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rYggkkYk.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AisAYoYc.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AisAYoYc.bat (0 bytes)

The process %original file name%.exe:3568 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DmAUkMkg.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YoEIoEUo.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DmAUkMkg.bat (0 bytes)

The process %original file name%.exe:2996 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NSEoowcQ.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AQQwMooM.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AQQwMooM.bat (0 bytes)

The process %original file name%.exe:2496 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FYUcQoYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uCYQAUgM.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FYUcQoYE.bat (0 bytes)

The process %original file name%.exe:928 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MwscoIgU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FyscQsgU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FyscQsgU.bat (0 bytes)

The process %original file name%.exe:2412 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gGowookg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\twQEgQwc.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\twQEgQwc.bat (0 bytes)

The process %original file name%.exe:2392 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\usQswYoI.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jIAwMYgc.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jIAwMYgc.bat (0 bytes)

The process %original file name%.exe:828 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iukgEUQU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gWIQIwko.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iukgEUQU.bat (0 bytes)

The process %original file name%.exe:2256 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sIgQQwEk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HuYYAIMU.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sIgQQwEk.bat (0 bytes)

The process %original file name%.exe:2796 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aAUYQgcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gIkgIoEA.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gIkgIoEA.bat (0 bytes)

The process %original file name%.exe:2252 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wMMoQEAA.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VwsMMMoA.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VwsMMMoA.bat (0 bytes)

The process %original file name%.exe:3772 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LmscEwQs.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SOAAMwEU.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SOAAMwEU.bat (0 bytes)

The process %original file name%.exe:2900 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oqEocAIc.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xEMIcsIQ.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xEMIcsIQ.bat (0 bytes)

The process %original file name%.exe:2472 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EaMcAQsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WeMwscsk.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WeMwscsk.bat (0 bytes)

The process %original file name%.exe:3628 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kKosksok.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIIkcYgU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oIIkcYgU.bat (0 bytes)

The process %original file name%.exe:2772 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MMcoYcMY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HyIIUMAg.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HyIIUMAg.bat (0 bytes)

The process %original file name%.exe:2776 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KycAAEYU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zUgMgAwQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zUgMgAwQ.bat (0 bytes)

The process %original file name%.exe:3140 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KucAAkkA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gaAcQMIY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\quEssMww.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HOUkEEEo.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KucAAkkA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HOUkEEEo.bat (0 bytes)

The process %original file name%.exe:3272 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IOIcQEck.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uccUUcQU.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uccUUcQU.bat (0 bytes)

The process %original file name%.exe:3148 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DcMYEkIw.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kgAgsEMk.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DcMYEkIw.bat (0 bytes)

The process %original file name%.exe:2308 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\okkEMMAo.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vqEgAwYs.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\okkEMMAo.bat (0 bytes)

The process %original file name%.exe:2540 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TiwEAwQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZKgckogQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZKgckogQ.bat (0 bytes)

The process %original file name%.exe:1716 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gassAQcw.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QYgwYEgE.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QYgwYEgE.bat (0 bytes)

The process %original file name%.exe:2980 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jGQksQEI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QWMkAQkU.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jGQksQEI.bat (0 bytes)

The process %original file name%.exe:4048 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kOgMkckU.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vaUsIQko.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vaUsIQko.bat (0 bytes)

The process %original file name%.exe:3388 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OIEokAEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jOswgwUQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jOswgwUQ.bat (0 bytes)

The process %original file name%.exe:2176 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qMQEEYEc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lkcUYYEU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lkcUYYEU.bat (0 bytes)

The process %original file name%.exe:3160 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EWUwYsIQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fWcQEEco.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EWUwYsIQ.bat (0 bytes)

The process %original file name%.exe:2076 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wKwwYkwY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\muwkMIQU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\muwkMIQU.bat (0 bytes)

The process %original file name%.exe:3580 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MowosgAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nKUIYQoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QcIwEgYs.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hiQIocMA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MowosgAg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QcIwEgYs.bat (0 bytes)

The process %original file name%.exe:3956 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zIkoEwMo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PwUYEsEI.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PwUYEsEI.bat (0 bytes)

The process %original file name%.exe:304 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LUEgUMsI.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hikAIoww.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hikAIoww.bat (0 bytes)

The process %original file name%.exe:3216 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oEAoIIQg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UkMAMcwo.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UkMAMcwo.bat (0 bytes)

The process %original file name%.exe:2764 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZoEQccQc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vaYMQYcY.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vaYMQYcY.bat (0 bytes)

The process %original file name%.exe:380 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eUQAEYEE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NiocYYMA.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eUQAEYEE.bat (0 bytes)

The process %original file name%.exe:1932 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rGgIoEcg.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lQgkQkkU.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lQgkQkkU.bat (0 bytes)

The process %original file name%.exe:1776 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OgEUgsUQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\waoUYMAk.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OgEUgsUQ.bat (0 bytes)

The process %original file name%.exe:240 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aUYIYMcY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AcscEkgI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PMcgQQAE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aaMskYwI.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AcscEkgI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PMcgQQAE.bat (0 bytes)

The process %original file name%.exe:388 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vCEIEkIA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MOMkEIsA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MCAQgAkY.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LGAIkYII.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vCEIEkIA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MOMkEIsA.bat (0 bytes)

The process %original file name%.exe:2836 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bKMsIogI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PUsYggkI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PUsYggkI.bat (0 bytes)

The process %original file name%.exe:3508 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ziAggAYA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qCAgIUck.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qCAgIUck.bat (0 bytes)

The process %original file name%.exe:2276 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xYYoQMgo.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ykoMYoUI.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ykoMYoUI.bat (0 bytes)

The process %original file name%.exe:244 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RisUIwgo.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dcMwcEEo.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RisUIwgo.bat (0 bytes)

The process %original file name%.exe:2576 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zeAwMMEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MIMQwQYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iiocMYsc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mQoMUUYk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lYccoAEI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imAAgYIA.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (540 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MIMQwQYs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imAAgYIA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeAwMMEw.bat (0 bytes)

The process %original file name%.exe:1840 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JOQEMAYI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DWAskUMs.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JOQEMAYI.bat (0 bytes)

The process %original file name%.exe:3016 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PKgQYwQo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AAIEMYkg.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PKgQYwQo.bat (0 bytes)

The process %original file name%.exe:2992 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MMcYokEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EykYYwgc.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EykYYwgc.bat (0 bytes)

The process %original file name%.exe:3096 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EeMkIAcE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QcYAIwUs.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QcYAIwUs.bat (0 bytes)

The process %original file name%.exe:644 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NcMAUock.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\acQEowkw.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NcMAUock.bat (0 bytes)

The process %original file name%.exe:2676 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hKgEoIUM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZQgcgkkk.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZQgcgkkk.bat (0 bytes)

The process %original file name%.exe:3188 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UIwgokYs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fSgIokoM.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fSgIokoM.bat (0 bytes)

The process %original file name%.exe:2372 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yUMEkMIY.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hSUIIQsY.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yUMEkMIY.bat (0 bytes)

The process %original file name%.exe:1224 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nkQQMgkY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fAoIAQMg.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fAoIAQMg.bat (0 bytes)

The process %original file name%.exe:3124 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bYUIAUMI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GqEAEEUM.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bYUIAUMI.bat (0 bytes)

The process %original file name%.exe:1228 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WkEcYYwg.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qmgoYkYI.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qmgoYkYI.bat (0 bytes)

The process %original file name%.exe:3696 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eOcoQssE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TSIkAsgI.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eOcoQssE.bat (0 bytes)

The process %original file name%.exe:2800 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XQYUAQQk.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jkEwYIQk.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jkEwYIQk.bat (0 bytes)

The process %original file name%.exe:1900 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rWQoAwEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CqEcUEAM.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rWQoAwEI.bat (0 bytes)

The process %original file name%.exe:2880 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vgooIccw.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vsUooIoM.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vgooIccw.bat (0 bytes)

The process %original file name%.exe:3368 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iusQYcoc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TSwkQQUU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TSwkQQUU.bat (0 bytes)

The process %original file name%.exe:1980 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HeMwUYcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\feIwEIcE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BkwoUkcU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VogYcwgw.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VogYcwgw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BkwoUkcU.bat (0 bytes)

The process %original file name%.exe:3692 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jmccUQEo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PMYIooQc.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PMYIooQc.bat (0 bytes)

The process %original file name%.exe:3360 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WGEgYcgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aegogUoI.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WGEgYcgA.bat (0 bytes)

The process %original file name%.exe:1988 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\suQYYwYI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QUkMIgcY.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\suQYYwYI.bat (0 bytes)

The process %original file name%.exe:3088 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NGgEEIwc.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EsgYwUQU.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EsgYwUQU.bat (0 bytes)

The process %original file name%.exe:1032 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iucscMwE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aEUkEMEA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iucscMwE.bat (0 bytes)

The process %original file name%.exe:3084 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sqgkkQkg.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BGAUYsgg.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sqgkkQkg.bat (0 bytes)

The process %original file name%.exe:2360 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nCEswUkU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zukoUEcs.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zukoUEcs.bat (0 bytes)

The process %original file name%.exe:3600 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OqggowoY.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SscAogYQ.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OqggowoY.bat (0 bytes)

The process %original file name%.exe:2152 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AwMsEgwM.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QeUEQggs.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AwMsEgwM.bat (0 bytes)

The process %original file name%.exe:636 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GkcEMscM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AwcssIcs.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AwcssIcs.bat (0 bytes)

The process %original file name%.exe:2580 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ruMAUcsE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wUssIscA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ruMAUcsE.bat (0 bytes)

The process %original file name%.exe:2420 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kuYIIUQI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wOUgUAks.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kuYIIUQI.bat (0 bytes)

The process %original file name%.exe:464 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (3921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RYEAscMY.bat (4 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (3777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xKIMEUMQ.bat (112 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (3753 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RYEAscMY.bat (0 bytes)

The process %original file name%.exe:3892 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AsYEQcIQ.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CQcgMokE.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CQcgMokE.bat (0 bytes)

The process %original file name%.exe:1596 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ugcUIIgk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VKUAQgYU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VKUAQgYU.bat (0 bytes)

The process %original file name%.exe:3520 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZUMYskUw.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zCQwsIwQ.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZUMYskUw.bat (0 bytes)

The process %original file name%.exe:3288 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SekAcgcA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JoogQMEI.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\geIIMoMo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LAcAswsY.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SekAcgcA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LAcAswsY.bat (0 bytes)

The process %original file name%.exe:2188 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YsMQoIYI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KsUkMUks.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YsMQoIYI.bat (0 bytes)

The process %original file name%.exe:3280 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jUwkoYgI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XWgQgsEo.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jUwkoYgI.bat (0 bytes)

The process %original file name%.exe:220 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xeAQgQAU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bUkAUAIo.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xeAQgQAU.bat (0 bytes)

The process %original file name%.exe:3688 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KSwQYcME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fEQoAkYQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fEQoAkYQ.bat (0 bytes)

The process %original file name%.exe:3444 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XwYcEwwU.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCMEwUYQ.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SCMEwUYQ.bat (0 bytes)

The process %original file name%.exe:3680 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KkwYUUIw.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mmUswwQM.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mmUswwQM.bat (0 bytes)

The process %original file name%.exe:1028 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PSgwwgAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eQwEkQkM.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PSgwwgAE.bat (0 bytes)

The process %original file name%.exe:2892 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AEMcgUcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XwoYsUQI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XwoYsUQI.bat (0 bytes)

The process %original file name%.exe:3964 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sMoAsQUY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lcYgUUsk.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lcYgUUsk.bat (0 bytes)

The process %original file name%.exe:3532 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mecYwwgk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IsgIgwEE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IsgIgwEE.bat (0 bytes)

The process %original file name%.exe:816 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LUIUowgI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yuoUQUwo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MgkIIUsQ.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rEskQEYA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LUIUowgI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yuoUQUwo.bat (0 bytes)

The process %original file name%.exe:1452 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jMoMQAQM.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NEscsQsc.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jMoMQAQM.bat (0 bytes)

The process %original file name%.exe:3116 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zCAkIwYc.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wMEocYwo.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wMEocYwo.bat (0 bytes)

The process %original file name%.exe:2100 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\boQIYsUY.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hEoscAoQ.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hEoscAoQ.bat (0 bytes)

The process %original file name%.exe:2692 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HacEYgQg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VCcIAgYY.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VCcIAgYY.bat (0 bytes)

The process %original file name%.exe:1108 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wQoAEoQQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NCMsAMoU.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wQoAEoQQ.bat (0 bytes)

The process %original file name%.exe:4080 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CiwcUowk.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cSEAgEss.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CiwcUowk.bat (0 bytes)

The process %original file name%.exe:2736 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xEgwMMcc.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wmoMQkwo.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xEgwMMcc.bat (0 bytes)

The process %original file name%.exe:3868 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kMckAIEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\doAUAoYI.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\doAUAoYI.bat (0 bytes)

The process %original file name%.exe:2868 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kkcgUwQM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tWYkAIco.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kkcgUwQM.bat (0 bytes)

The process %original file name%.exe:3632 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eMEwQkoM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WcIYgkQQ.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eMEwQkoM.bat (0 bytes)

The process %original file name%.exe:2436 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZkIIEkkU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WgYUAEoo.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZkIIEkkU.bat (0 bytes)

The process %original file name%.exe:3460 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cKsEUggA.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VOIcIsEQ.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cKsEUggA.bat (0 bytes)

The process %original file name%.exe:2816 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BswcogUk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TWAIQkQU.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BswcogUk.bat (0 bytes)

The process %original file name%.exe:2948 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OQwgQYcg.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RYsQkAwM.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RYsQkAwM.bat (0 bytes)

The process %original file name%.exe:3068 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RUMEkMIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gIkgEEwM.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RUMEkMIU.bat (0 bytes)

The process %original file name%.exe:1052 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sqYEYIsw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JuUUkUEk.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sqYEYIsw.bat (0 bytes)

The process %original file name%.exe:2944 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pWQAMgIY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MOUQQUsY.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pWQAMgIY.bat (0 bytes)

The process %original file name%.exe:2340 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GaoYUAEw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cYAUooAc.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cYAUooAc.bat (0 bytes)

The process %original file name%.exe:2228 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SGkEEsEQ.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RQgoYwMg.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SGkEEsEQ.bat (0 bytes)

The process %original file name%.exe:3196 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jiQkcUcQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZoAMUowU.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZoAMUowU.bat (0 bytes)

The process %original file name%.exe:3432 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tqMMYcsk.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pAMIYYQE.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pAMIYYQE.bat (0 bytes)

The process %original file name%.exe:4004 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aUswAQso.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QYIkswoc.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QYIkswoc.bat (0 bytes)

The process %original file name%.exe:2348 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tcEwUAIg.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bAkMUsYY.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tcEwUAIg.bat (0 bytes)

The process %original file name%.exe:1196 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cawckwMs.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DqsEEkss.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cawckwMs.bat (0 bytes)

The process %original file name%.exe:1568 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zAkQQIEk.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nmwwwgoI.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zAkQQIEk.bat (0 bytes)

The process %original file name%.exe:2036 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wmcUEIYg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xqMcAcsw.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xqMcAcsw.bat (0 bytes)

The process %original file name%.exe:2672 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VwQgoMcw.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The process %original file name%.exe:3480 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IeMUkcAc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vUkkUoYM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ieUkAYsM.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MwQQkAUg.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IeMUkcAc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vUkkUoYM.bat (0 bytes)

The process %original file name%.exe:2748 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mQwAEAAQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jmscsoIY.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jmscsoIY.bat (0 bytes)

The process %original file name%.exe:3812 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gyUEQQAk.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NMgcQksw.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NMgcQksw.bat (0 bytes)

The process %original file name%.exe:2500 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aisIAAAE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JUAcIkss.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aisIAAAE.bat (0 bytes)

The process %original file name%.exe:3916 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\suwUoEMw.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HWosQYYI.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\suwUoEMw.bat (0 bytes)

The process %original file name%.exe:2724 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AAoQUIsI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pmYgMwsI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pmYgMwsI.bat (0 bytes)

The process %original file name%.exe:612 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scgcYYQI.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vmoogEMM.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scgcYYQI.bat (0 bytes)

The process %original file name%.exe:1816 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KuowMoog.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XmAIEwsA.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KuowMoog.bat (0 bytes)

The process %original file name%.exe:1608 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kUkYsIUE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rEQcAUUg.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rEQcAUUg.bat (0 bytes)

The process %original file name%.exe:3428 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BqcAYQgM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rcAQosEI.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rcAQosEI.bat (0 bytes)

The process %original file name%.exe:3228 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EggcIsww.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PysUoIwc.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PysUoIwc.bat (0 bytes)

The process %original file name%.exe:1860 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\maAQoIcg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dkAUggUo.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dkAUggUo.bat (0 bytes)

The process %original file name%.exe:1600 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GEYQgwYo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ioIwUkQg.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WCkMsAwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SQAsAscY.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SQAsAscY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ioIwUkQg.bat (0 bytes)

The process %original file name%.exe:940 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gEgoMoos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wgoMcQAc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nSEoAoww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mMcckssw.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nSEoAoww.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mMcckssw.bat (0 bytes)

The process %original file name%.exe:356 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YIQcssYE.bat (4 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OKogQIAc.bat (112 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YIQcssYE.bat (0 bytes)

The process %original file name%.exe:2004 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SEQUsIoA.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IeoEQkQc.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IeoEQkQc.bat (0 bytes)

The process %original file name%.exe:3224 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ckIcsIAA.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YiYAsAAU.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YiYAsAAU.bat (0 bytes)

The process %original file name%.exe:2604 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mUUQEwow.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JcAIIAsk.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JcAIIAsk.bat (0 bytes)

The process %original file name%.exe:3340 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RscEMcgY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lWYMAEEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dGkswsIU.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bUgQYUww.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lWYMAEEw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bUgQYUww.bat (0 bytes)

The process %original file name%.exe:804 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IkkQUQow.bat (112 bytes)
C:\d4a55cc7b461baa492d09def48760fb6 (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VosAgIgw.bat (4 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VosAgIgw.bat (0 bytes)

The process NesIMIQs.exe:228 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (7726 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (2321 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (30812 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (2321 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (3073 bytes)
C:\totalcmd\TCUNINST.EXE.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (3073 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (3361 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (3073 bytes)
C:\totalcmd\TCMDX32.EXE.exe (3361 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (3361 bytes)
C:\totalcmd\TcUsbRun.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (5441 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (2321 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

Registry activity

The process %original file name%.exe:3076 makes changes in the system registry.