Gen.Variant.Kazy.530639_88909f632d – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:1300
cscript.exe:572
cscript.exe:1908
cscript.exe:1056
cscript.exe:524
cscript.exe:320
cscript.exe:1520
cscript.exe:544
cscript.exe:328
cscript.exe:528
cscript.exe:448
cscript.exe:208
cscript.exe:440
cscript.exe:1136
cscript.exe:1276
cscript.exe:1152
cscript.exe:120
cscript.exe:1932
cscript.exe:148
cscript.exe:224
cscript.exe:480
cscript.exe:1644
cscript.exe:1824
cscript.exe:1628
cscript.exe:968
cscript.exe:536
cscript.exe:2000
cscript.exe:412
cscript.exe:920
cscript.exe:1416
cscript.exe:516
%original file name%.exe:592
%original file name%.exe:1300
%original file name%.exe:1144
%original file name%.exe:196
%original file name%.exe:1784
%original file name%.exe:456
%original file name%.exe:1876
%original file name%.exe:448
%original file name%.exe:692
%original file name%.exe:1544
%original file name%.exe:1324
%original file name%.exe:852
%original file name%.exe:1964
%original file name%.exe:1652
%original file name%.exe:1016
%original file name%.exe:1244
%original file name%.exe:308
%original file name%.exe:1096
%original file name%.exe:440
%original file name%.exe:1312
%original file name%.exe:1336
%original file name%.exe:148
%original file name%.exe:120
%original file name%.exe:1932
%original file name%.exe:1276
%original file name%.exe:1540
%original file name%.exe:1288
%original file name%.exe:536
%original file name%.exe:476
%original file name%.exe:532
%original file name%.exe:1512

The Trojan injects its code into the following process(es):

rSwooYMM.exe:1176
jWcYYUcg.exe:512
FeEQMIQs.exe:1232

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process rSwooYMM.exe:1176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
\\STORAGE2\PIPE\srvsvc (72 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process %original file name%.exe:592 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lSIUEocQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qCkIYUww.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qCkIYUww.bat (0 bytes)

The process %original file name%.exe:1300 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AAgcQMUA.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FCQUkEkg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AAgcQMUA.bat (0 bytes)

The process %original file name%.exe:1144 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JyMkwYsU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QoMcckgs.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JyMkwYsU.bat (0 bytes)

The process %original file name%.exe:196 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UokcsIgk.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\voYQUkYs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UokcsIgk.bat (0 bytes)

The process %original file name%.exe:1784 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SmMsIYYE.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kWIAUEkA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kWIAUEkA.bat (0 bytes)

The process %original file name%.exe:456 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kWUwcUUY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEYMIAsc.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BEYMIAsc.bat (0 bytes)

The process %original file name%.exe:1876 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gsQowscE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AcYIkoMA.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AcYIkoMA.bat (0 bytes)

The process %original file name%.exe:448 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PUkIIoIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iuYMkwkw.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PUkIIoIw.bat (0 bytes)

The process %original file name%.exe:692 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DQkEIYog.bat (112 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZUIIckIY.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7833 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZUIIckIY.bat (0 bytes)

The process %original file name%.exe:1544 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PeMowgsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\deUAgEgk.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\deUAgEgk.bat (0 bytes)

The process %original file name%.exe:1324 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SGQssksk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PQkAkIcc.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PQkAkIcc.bat (0 bytes)

The process %original file name%.exe:852 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SUggYoUY.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lAMskEgo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lAMskEgo.bat (0 bytes)

The process %original file name%.exe:1964 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fMIIsQgE.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RMsMUQoY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fMIIsQgE.bat (0 bytes)

The process %original file name%.exe:1652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eMcYgoQI.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lMoAwQgU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eMcYgoQI.bat (0 bytes)

The process %original file name%.exe:1016 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eEYkkAoc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YOAQMUAs.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YOAQMUAs.bat (0 bytes)

The process %original file name%.exe:1244 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KEQkcQsM.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jkMMIMQs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KEQkcQsM.bat (0 bytes)

The process %original file name%.exe:308 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aSAsMkQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eYMEIIck.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aSAsMkQk.bat (0 bytes)

The process %original file name%.exe:1096 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EYscMQIw.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aWkssAMw.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aWkssAMw.bat (0 bytes)

The process %original file name%.exe:440 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIgYMwAU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PuIcsMgk.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oIgYMwAU.bat (0 bytes)

The process %original file name%.exe:1312 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PwgAoYEg.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XyAkQsIU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PwgAoYEg.bat (0 bytes)

The process %original file name%.exe:1336 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iGcQYkUM.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fyUAoYIU.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fyUAoYIU.bat (0 bytes)

The process %original file name%.exe:148 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZoEkUIks.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rEcgkcgY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rEcgkcgY.bat (0 bytes)

The process %original file name%.exe:120 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NkoQkAMk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kEEgcAAE.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kEEgcAAE.bat (0 bytes)

The process %original file name%.exe:1932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QWsUMAoM.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ksYMEMsE.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QWsUMAoM.bat (0 bytes)

The process %original file name%.exe:1276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UgQQYcMQ.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EOAAQwQc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UgQQYcMQ.bat (0 bytes)

The process %original file name%.exe:1540 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ogIkMgIk.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pEoQAwAA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ogIkMgIk.bat (0 bytes)

The process %original file name%.exe:1288 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZEAkkgIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YGkgMEEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IoAwUEgg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gSIIoAMM.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UaEYAYYc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sKoggoMY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZEAkkgIw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gSIIoAMM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YGkgMEEI.bat (0 bytes)

The process %original file name%.exe:536 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nKAcAcUc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JQwcAcMg.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JQwcAcMg.bat (0 bytes)

The process %original file name%.exe:476 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OQYYocck.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AeoggUMQ.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AeoggUMQ.bat (0 bytes)

The process %original file name%.exe:532 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ecIwkcsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YkUAwEAk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NugAEQks.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ueggkQsg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NugAEQks.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ueggkQsg.bat (0 bytes)

The process %original file name%.exe:1512 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\euwgUggk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zsQocIkg.bat (112 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\euwgUggk.bat (0 bytes)

Registry activity

The process cscript.exe:1300 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 26 FB 0F 17 34 21 2B 49 8E 59 EB 9E 03 72 A9"

The process cscript.exe:572 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 57 5A 6D 09 4E 29 1D FA E1 CB 13 D4 C8 50 1F"

The process cscript.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 72 E6 0E 77 B9 C0 74 56 72 E4 A4 CF F2 79 BB"

The process cscript.exe:1056 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 94 79 FF 5C 3C B4 F9 4A 3A 52 88 F0 25 C1 77"

The process cscript.exe:524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 1E 66 D9 D9 67 84 D3 DD 63 4C 0C A1 BA 69 AB"

The process cscript.exe:320 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 BD 09 B3 84 96 09 01 4B E8 97 A8 BD 22 58 F6"

The process cscript.exe:1520 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C 10 6C D6 43 87 95 98 53 79 84 D9 A1 73 8F C4"

The process cscript.exe:544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 2E BB D9 51 02 B2 1D 50 43 3A 86 19 DC 1D E2"

The process cscript.exe:328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 B0 F5 D2 16 FC 58 E1 87 BB DD 4C B2 18 A1 1E"

The process cscript.exe:528 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 97 82 DF 7D C2 6C 62 9B A2 1F CD 51 0C 9C 4C"

The process cscript.exe:448 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F D7 59 A5 56 D2 A6 EE 01 1D 2E 22 20 0E 21 81"

The process cscript.exe:208 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 CD A4 58 B1 29 F4 93 74 F9 C9 D4 AE 5A EC B3"

The process cscript.exe:440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 37 84 12 91 79 BF A9 D9 86 2D A2 FB 00 94 E3"

The process cscript.exe:1136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 0C 5F 59 83 41 49 69 EF 99 D5 79 77 49 F3 80"

The process cscript.exe:1276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 19 A2 C5 CF 26 EB 05 7B EF DE 1F 7D 14 7F D0"

The process cscript.exe:1152 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 6D FF 80 F0 9F C8 D6 5D 92 73 78 10 D1 01 CA"

The process cscript.exe:120 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 CB 5F 2F BF 86 85 BD EA 5B F6 BC 39 55 83 A3"

The process cscript.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 0B 9D D5 65 93 C2 8C 1A ED 54 A7 8F 70 3F 99"

The process cscript.exe:148 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 86 E8 D6 B8 1E F1 C9 E7 F5 32 E8 3B 97 98 37"

The process cscript.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 F8 3B EF 90 0F 50 54 9B 5E C5 D1 63 D7 1F 80"

The process cscript.exe:480 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 80 ED 86 62 CD 02 D9 C0 23 DC 77 24 4F AD 14"

The process cscript.exe:1644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B FF 38 9E 4C 82 67 E0 17 3D FD A5 08 C8 F2 2D"

The process cscript.exe:1824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B 78 9A 51 29 8F D9 20 40 BC 24 6B F1 29 3B C0"

The process cscript.exe:1628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 96 25 C3 35 C6 C4 07 76 58 29 48 CD E1 3B 33"

The process cscript.exe:968 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 29 E9 74 9C DA 7A F7 2D 3C 3F 3D 77 D6 A7 42"

The process cscript.exe:536 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 7D 11 0C 21 48 7A E3 B9 9C 35 1C 64 94 1D C5"

The process cscript.exe:2000 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 96 6D C1 D1 94 A0 FF A6 F5 A7 6E 49 83 A6 F1"

The process cscript.exe:412 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 E0 35 15 DA C2 2C 6B 2D 75 99 1C FA 0E D8 41"

The process cscript.exe:920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 78 97 B3 45 B4 31 74 06 89 1F AE 6E EC DB 0D"

The process cscript.exe:1416 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 F4 F1 1A 9B 4E D9 19 84 D7 05 33 7E 0D 93 9F"

The process cscript.exe:516 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 95 71 D3 CB 30 45 53 41 B6 FB E0 8D 7A 0E F4"

The process rSwooYMM.exe:1176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 93 19 D5 10 BA BD A8 5A 11 D7 DE DE DD 7F 38"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process %original file name%.exe:592 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 34 EB A8 8D FB 0C 55 02 C3 87 00 01 CD B2 78"

The process %original file name%.exe:1300 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 A8 2C 9D 2E C5 30 C5 9C CB F8 B7 A8 13 7E EB"

The process %original file name%.exe:1144 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 69 A2 90 4C 5D E6 0B 85 9D 1A A7 8F 2E 00 D4"

The process %original file name%.exe:196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 4E 69 68 D5 6B B5 1D 1D 8E 80 87 C1 F8 2D AB"

The process %original file name%.exe:1784 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A B5 D4 C7 A1 36 E0 51 08 41 F4 7D B0 A3 AE 5E"

The process %original file name%.exe:456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 5D 30 DA 6B 2A 9E 52 6C D3 9C 8E 87 5C 51 29"

The process %original file name%.exe:1876 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 90 76 9A 46 81 CF 5A DE 0D 57 16 F0 42 D4 20"

The process %original file name%.exe:448 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 AD 62 6D 5C 60 B1 AD 74 FD 4A 0B 14 0C 03 15"

The process %original file name%.exe:692 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 7E C5 CA EF 64 06 4C 40 D6 4A DF 61 04 ED 11"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process %original file name%.exe:1544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 14 0D 8B DF 76 AC 36 66 4D 3A 42 0C A5 F9 EF"

The process %original file name%.exe:1324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 1D 10 8D 6F 51 C2 0B ED 07 A7 5D 47 01 2E F7"

The process %original file name%.exe:852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF A7 4B 3D 80 2E 41 47 30 D9 9E 20 4F C7 B8 22"

The process %original file name%.exe:1964 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 7E DA 80 6D 81 45 35 55 32 8E 6E 08 40 85 0D"

The process %original file name%.exe:1652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 37 AD 2C DA 41 A1 F8 B0 24 60 04 31 67 86 22"

The process %original file name%.exe:1016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 F8 A3 EB 8A 33 E8 97 74 6E 91 F8 C2 7A 64 28"

The process %original file name%.exe:1244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 3B 9C 13 44 57 05 75 D8 1A 95 31 A0 29 44 4D"

The process %original file name%.exe:308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 7B 68 E8 12 7D 84 1A 6F 9D 68 C3 19 19 CF D2"

The process %original file name%.exe:1096 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 15 D3 D6 2B 66 E7 95 51 50 11 53 69 24 1A F0"

The process %original file name%.exe:440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 86 A3 00 24 36 B7 CF 9C 2F EB 53 89 58 3F 47"

The process %original file name%.exe:1312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 9D BA 4B 89 6E DA B3 B3 EA 7D 4A B9 B2 A4 C2"

The process %original file name%.exe:1336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 DA CE B9 B1 5E A0 E4 C3 1F 99 0F 77 57 03 2C"

The process %original file name%.exe:148 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 C9 0C 1B 0C 57 D6 8C 96 76 E6 E2 23 73 74 B0"

The process %original file name%.exe:120 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B AF 36 61 0C 25 3F 58 F7 D0 C1 D4 90 1F 1D CA"

The process %original file name%.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 1F 2D 31 8D 88 A1 ED 9C B4 38 FE E3 E6 C4 62"

The process %original file name%.exe:1276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 73 85 9F 17 FB AC 9B C9 BE 6C 28 3A 9D 71 F1"

The process %original file name%.exe:1540 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 7B 49 D9 6B E4 39 BC CC 40 EF B9 FD 04 74 55"

The process %original file name%.exe:1288 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 83 52 02 B8 F3 5B 40 47 92 3F E4 06 5B 81 B8"

The process %original file name%.exe:536 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F DC 13 EF DC 46 4C C8 C6 E3 48 F5 51 AF A2 3F"

The process %original file name%.exe:476 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 B3 9A 04 47 F1 5B 5D A8 C8 72 64 91 53 32 1D"

The process %original file name%.exe:532 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 27 DD 4B 1C 41 C1 BA 8F 3E 8D BA D6 0F 3A 89"

The process %original file name%.exe:1512 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 A7 FB C2 7E AA 60 1A 0B FA 1D 9B 58 C2 7F EF"

The process jWcYYUcg.exe:512 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED DB 40 7E 18 38 B4 47 8B 39 8B 71 61 41 FD ED"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The process FeEQMIQs.exe:1232 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 B6 0B EB FA D8 28 D8 57 E0 58 61 8C 3A BE 65"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

Dropped PE files

MD5	File path
8f402d0e6a3b75789892bbcb40587f82	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
c76f47396069a59ca642f4a9c671c0de	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
7139b4b87c184824cee088701c9985ca	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
f1419ecbab08eedf74435c76ebe0c3f5	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
cafe8a15a524cab99079d8f0c1302b4d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
0d1355dd27eecdb88b773d14972e6878	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
f82b9df425953ccb59e28c7e13994884	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
4bec72086f616a0100e7edfb925ff54e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
ea7b3feced41fec4f1e15651fbf6fe8e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
2976137ffde349f36325130c20b0ebbe	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
c7d1e01f3710839af3dc2d412761047c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
cb32f9e7d0e6c2f51b7cde0e153fef29	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
6a2255c7255a9b4128f1e002ae4bb417	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
31bf5af7a52751e8788e471e83d4da97	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
31ccc28785be43d17c3ebef4d50c0118	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
8e175bf3ed1f0fbb121cfee84da66c88	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
98577ebbb5c857f81318e3f4d7416d59	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
1af6457db00b94b0100f75bbdc38f64c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
c9813ced51c69bc91981b1d50da37ed2	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
43f5a956c1cb396056c62efc50a6641e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
e931d9710f3e20ff2d519822a5fdb1f8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
4330a9c5d0d4c2ea46f8c01cbc818ee8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
a6529e088fa77c9b270bde698b8aeefb	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
b8754c99bdd5c6675492697c08a6c7a6	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
b931b91d494c8c428d2d69f732b7935f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
a3f598c14e9a787a834bb0472ea4b48f	c:\Documents and Settings\All Users\BOAMIgUE\jWcYYUcg.exe
7b5e000c5b079c02454ac62528021dfc	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
a0c0feae85219ec51fa820a7eb8d3920	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
43e5b5237d4ca4681cafc9ac60330395	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
164d6efe13d59a0e2a94da6c5ab87a57	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
7156deb55bb7e2341d5fa505bb47e7d2	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
c32f3d81afb0a15d704473d2a74beb21	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
89e17d2f1f8850fd5088c471f648ec40	c:\Documents and Settings\All Users\hUEQccwo\FeEQMIQs.exe
01bcd13ccf63fec7b117c8cd2f49c34e	c:\Documents and Settings\"%CurrentUserName%"\NwIscAww\rSwooYMM.exe
eadae8d6d721c8c2e55addb68e904cb0	c:\Perl\eg\IEExamples\ie_animated.gif.exe
dd4e657f10b4230b42ad70d9b548ca09	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
c7c3a6440511d05532c7975da0d00943	c:\Perl\eg\aspSamples\ASbanner.gif.exe
10b05655fc20ffca024d1e34d0b35ba5	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
940962e20fd28e7e5fec8898b147cdca	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
0967c503cb94158ccc8c9bd854e17d9e	c:\Perl\html\images\AS_logo.gif.exe
4538faeb17c88c9bd5aaa93e37a4969e	c:\Perl\html\images\PerlCritic_run.png.exe
30b7fd1ba80b1d9dfecc8852cf979352	c:\Perl\html\images\aslogo.gif.exe
3677e4ebc1f21d24e0d6108c5d4d1ebe	c:\Perl\html\images\ppm_gui.png.exe
2e31571442510b3f7799be79e13a7537	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
1a4bdf800f5ad1860c706373c9a61178	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
3a9a1a67667a15beb66e61e7ad487084	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
174a037d92ba79372a1bacd8e9c45def	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
45795ad391456cdf2e86d321acf9fd2a	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
e87affbe4d097bb486474330b6d1002c	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
d0fbf761e4ca5e2e8a5310f3c287fe57	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
78a1d525d57d81e20851be050f24588c	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
a4e0e7675a18a19f7805c5ff218ed551	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
175bdefdc6d019c0a335716e9435528b	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
cscript.exe:1300
cscript.exe:572
cscript.exe:1908
cscript.exe:1056
cscript.exe:524
cscript.exe:320
cscript.exe:1520
cscript.exe:544
cscript.exe:328
cscript.exe:528
cscript.exe:448
cscript.exe:208
cscript.exe:440
cscript.exe:1136
cscript.exe:1276
cscript.exe:1152
cscript.exe:120
cscript.exe:1932
cscript.exe:148
cscript.exe:224
cscript.exe:480
cscript.exe:1644
cscript.exe:1824
cscript.exe:1628
cscript.exe:968
cscript.exe:536
cscript.exe:2000
cscript.exe:412
cscript.exe:920
cscript.exe:1416
cscript.exe:516
%original file name%.exe:592
%original file name%.exe:1300
%original file name%.exe:1144
%original file name%.exe:196
%original file name%.exe:1784
%original file name%.exe:456
%original file name%.exe:1876
%original file name%.exe:448
%original file name%.exe:692
%original file name%.exe:1544
%original file name%.exe:1324
%original file name%.exe:852
%original file name%.exe:1964
%original file name%.exe:1652
%original file name%.exe:1016
%original file name%.exe:1244
%original file name%.exe:308
%original file name%.exe:1096
%original file name%.exe:440
%original file name%.exe:1312
%original file name%.exe:1336
%original file name%.exe:148
%original file name%.exe:120
%original file name%.exe:1932
%original file name%.exe:1276
%original file name%.exe:1540
%original file name%.exe:1288
%original file name%.exe:536
%original file name%.exe:476
%original file name%.exe:532
%original file name%.exe:1512
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
\\STORAGE2\PIPE\srvsvc (72 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lSIUEocQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qCkIYUww.bat (4 bytes)
C:\88909f632d203fb23d71991f697efd66 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AAgcQMUA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FCQUkEkg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JyMkwYsU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QoMcckgs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UokcsIgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\voYQUkYs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SmMsIYYE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kWIAUEkA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kWUwcUUY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEYMIAsc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gsQowscE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AcYIkoMA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PUkIIoIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iuYMkwkw.bat (112 bytes)
%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DQkEIYog.bat (112 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZUIIckIY.bat (4 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PeMowgsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\deUAgEgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SGQssksk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PQkAkIcc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SUggYoUY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lAMskEgo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fMIIsQgE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RMsMUQoY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eMcYgoQI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lMoAwQgU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eEYkkAoc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YOAQMUAs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KEQkcQsM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jkMMIMQs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aSAsMkQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eYMEIIck.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EYscMQIw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aWkssAMw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIgYMwAU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PuIcsMgk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PwgAoYEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XyAkQsIU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iGcQYkUM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fyUAoYIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZoEkUIks.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rEcgkcgY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NkoQkAMk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kEEgcAAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QWsUMAoM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ksYMEMsE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UgQQYcMQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EOAAQwQc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ogIkMgIk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pEoQAwAA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZEAkkgIw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YGkgMEEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IoAwUEgg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gSIIoAMM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UaEYAYYc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sKoggoMY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nKAcAcUc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JQwcAcMg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OQYYocck.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AeoggUMQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ecIwkcsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YkUAwEAk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NugAEQks.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ueggkQsg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\euwgUggk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zsQocIkg.bat (112 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	995328	994816	5.46429	a406fcb4a27d7ef1a73f69d9fac19bf3
.rdata	999424	4096	512	1.94431	9526db527a2fb32ab9bfd7ef125be387
.data	1003520	5	512	0.067931	9a7682ab0a19c9a5142ca782e56bf12a
.rsrc	1007616	4444	4608	2.90977	db176331dd33fbe59f160f9de9606152

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://173.194.112.65/
hxxp://google.com/

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=JLkZVcXIM-mG8QffnIGAAw

Content-Length: 262

Date: Mon, 30 Mar 2015 20:59:16 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=JLkZVcXIM-mG8QffnIGAAw">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

rSwooYMM.exe_1176:

.text

.rdata

@.data

b5.ug

=D.BD_

5og3%C

^ d%d

twEb

%dh%3

^X.nc^fa{,

@!(%S

{Y.rY7

.YP`^

h3.CVv

k$%S-

~35.pp

k%Uxi

Dn%Ci~}P

NPA%Xz

z@%Fz

|j.iu

E 6.cG

k:\:iA

'iM.pp

P.WVa

,B.GyY

S%Sy^

.2.lZN

NSqL

@x.JD

%d|@I

%C}%L

K-z}f64

i.frX

\.FI#"

o#.QNif

Y.zhASB"s

B4%dM

Ã½d1&R

:.DT,?

kia%D

e%fr#

$ D-J}

X.eAe;d,

6*.Jp

!VAy.oN!/

[B\%xSCQo

.YSR#?

t$3c!

.AaRN9

%dqiH

{ssh0

.hsx]`

*.Wz?

=1.UL

%D$mL

:.Kw=u

%U^M"[,

yDT{%F

Windows Internet Explorer

Windows Task Manager

taskmgr.execmd.exetaskkill /F /IM taskmgr.exe /T

jWcYYUcg.exe

ec.exe

ug.hh

(Ux.bBw]L

!J|.bJuIL

).bY~\L

<_v.bj>

;Wz.bPkIL

Microsoft Windows

kernel32.dll

user32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global III is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

rSwooYMM.exe_1176_rwx_009A0000_00001000:

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

FeEQMIQs.exe_1232:

.text

.rdata

@.data

b5.ug

.hFgU

.oe`"

t!.lN-=

t&t%xG

TcPoopUk

') 2ÃŸ

.xXlT '

A%fSx01/

-.xOf(

.Gr6nGTny

/T%x8f3x\

-Ã•O3C]i5

.lUnl

dxGjY4%x(

mNUk.xG

.Gm@tt

dFX.xG

C%uYlI

&%6XG

.Vk\.

k.qNk

%XmTgX

> %XUPC,i

'.Tf-

%X]Q|

.TV]S

rP[.wO

h`2%f%

fR[.wO

.FtjhY

S[.wg

.am$%

fR[.wN

v[[.wI

,[.wG

Uk!F%SEQF

4[.ww

.Al|3

x.pzNbR

fR[.wI

u[[.wI

E8[.wc

]%Cs,

fR[.wH

S[.wl

S[.wu

S[.wx

r/%u.

vQ[.wO

L.WZyu

L[.wl

p[.wu

b.Gr,.

L[.wz

S[.wz

f.KpV

D[.wu

w\[.wL

,[.ws

g%fxM1

,[.wt

fR[.wD

wS[.wJ

ZbXBSsh

|[.wv

P[.wH

U[.wI

wR[.wq

vQ[.wJ

fR[.wL

vV[.wI

-3%x(

l[.wc

|[.wq

cX.SA

*`.VR

S[.wv

,[.wv

R[.wO

L[.wN

e#.TP

,[.wz

Af%d

Q[.wH

wP[.ww

Z[.wy

L[.wv

S[.wp

uY[.wO

5"%xdF

w\[.wy

nP.BE

%co ,

2#C

iTCpb

l[.wv

.cqdT

4[.wc

H'%Uzo}m

&T.cp

b{y.xGy

v[[.wH

.Nfe`

wP[.wz

ht%F:jT

n\[.wy

tQ[.wH

,[.wb

{.lng

w\[.ww

6[.wt

,[.wl

3]9%UA{

,[.wu

p[[.wF

v4[.wG

pKt[.wK

p[.wp

5.fz%

V[.wH

l[.wq

sQ[.wH

w\[.wz

P[.wv

~j-2}|

T=.je2

;bG.YY|

fR[.wE

rU[.wG

/O[.wK

vL[.wG

e\[.wG

\[.wG

WwP[.wp

v".bBal

Microsoft Windows

`N?>.wr

r>.Pz

Y?>.wr

X?>.zR

1t%UF

ntdll.dll

shell32.dll