Gen.Variant.Kazy.563854_1909e387c3 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:604
cscript.exe:536
cscript.exe:1272
cscript.exe:336
cscript.exe:1136
cscript.exe:1988
cscript.exe:1920
cscript.exe:388
cscript.exe:240
cscript.exe:736
cscript.exe:1928
cscript.exe:980
%original file name%.exe:1176
%original file name%.exe:1828
%original file name%.exe:1284
%original file name%.exe:1272
%original file name%.exe:1712
%original file name%.exe:1956
%original file name%.exe:2020
%original file name%.exe:2004
%original file name%.exe:1384
%original file name%.exe:176
%original file name%.exe:1488
%original file name%.exe:172
%original file name%.exe:220

The Trojan injects its code into the following process(es):

zuMEoUcg.exe:856
hmwooYMM.exe:1556
hEMQMIQs.exe:1472
hEMQMIQs.exe:1848

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OCMMogQg.bat (4 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oiYUMsUs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OCMMogQg.bat (0 bytes)

The process %original file name%.exe:1828 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VwoQYYQc.bat (112 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ceAkMQcg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ceAkMQcg.bat (0 bytes)

The process %original file name%.exe:1284 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eeggIkAY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bagEQEEY.bat (4 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bagEQEEY.bat (0 bytes)

The process %original file name%.exe:1272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VMUkQUsU.bat (112 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eKMkUsQY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eKMkUsQY.bat (0 bytes)

The process %original file name%.exe:1712 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ziIIIEok.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OgQsEUAI.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OgQsEUAI.bat (0 bytes)

The process %original file name%.exe:1956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MccEIYUw.bat (112 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qIoYAgcY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qIoYAgcY.bat (0 bytes)

The process %original file name%.exe:2020 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OaAEoMwI.bat (112 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OicokQYk.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OicokQYk.bat (0 bytes)

The process %original file name%.exe:2004 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DmIYwEYM.bat (4 bytes)
%Documents and Settings%\All Users\xWAMIgUE\zuMEoUcg.exe (7881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SGgUIgQk.bat (112 bytes)
%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe (7857 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe (7905 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DmIYwEYM.bat (0 bytes)

The process %original file name%.exe:1384 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\keQkYAAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VSQUQcIc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\keQkYAAE.bat (0 bytes)

The process %original file name%.exe:176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eAYkIcYY.bat (112 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GCUEgwwo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GCUEgwwo.bat (0 bytes)

The process %original file name%.exe:172 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pCowcYEI.bat (4 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fWoAQsEM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pCowcYEI.bat (0 bytes)

The process %original file name%.exe:220 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XOIsoUkI.bat (4 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HSYQIAUs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XOIsoUkI.bat (0 bytes)

The process hmwooYMM.exe:1556 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\NAAo.txt (52690 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)

Registry activity

The process cscript.exe:604 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 D5 63 FF 05 1D 83 FD F6 DA 2B 97 EE 93 E7 2C"

The process cscript.exe:536 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 AD 80 27 1A 33 4D EA 75 98 5C 7C A7 CA 11 3B"

The process cscript.exe:1272 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 AF E6 2C DE B9 0E 35 06 D4 88 A5 81 45 4F 1A"

The process cscript.exe:336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA A4 53 26 ED A3 F0 A2 D8 50 F0 FB 2B 52 B0 EA"

The process cscript.exe:1136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 95 3E 67 1E AD DD C2 43 FB D9 A7 D6 33 3F 1C"

The process cscript.exe:1988 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 13 13 03 3C 20 6E 3A AA FD B9 CE 3C 10 34 27"

The process cscript.exe:1920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 3D AD 9D DE EF 1E 87 C1 E7 79 26 BC 21 E2 CC"

The process cscript.exe:388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 CB 5D 82 6C B1 5B A5 62 BA E1 A3 C7 57 7E 08"

The process cscript.exe:240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 CD 04 5E D4 12 F9 68 EB 5D 6B 52 59 83 8B C0"

The process cscript.exe:736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A A2 07 6C 34 99 9D 40 18 34 C1 35 DC CC 7C EE"

The process cscript.exe:1928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 18 D2 99 83 36 84 1E E3 36 CC 8F D3 31 DB 48"

The process cscript.exe:980 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 B1 5C CA 77 EA BF AC 73 74 F5 9C 12 31 AA 0C"

The process zuMEoUcg.exe:856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 AC 6E 1B B6 08 E1 85 45 F1 47 9F 58 D6 AE 8C"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

The process %original file name%.exe:1176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F FC 5A D4 77 BD 65 07 E4 0A E3 E5 5D F7 E3 DF"

The process %original file name%.exe:1828 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 8D 40 5F 89 2C BD 3B 2A CC 89 B7 80 2A 31 E0"

The process %original file name%.exe:1284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 6B B1 49 98 4F 57 1D 6A CC 77 E8 68 2B AA 78"

The process %original file name%.exe:1272 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 2F 1D A8 E5 80 3D 85 C6 96 0F F8 CB A2 14 C1"

The process %original file name%.exe:1712 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 4F E9 C5 E2 93 B0 D6 D9 7E E2 91 24 7F FB 27"

The process %original file name%.exe:1956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 C6 E3 F3 1B 1D 69 DE 72 7B 55 F9 FC 36 0F CA"

The process %original file name%.exe:2020 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 C6 F4 AC C5 CB AD C3 F3 44 DF 2E 71 18 A8 81"

The process %original file name%.exe:2004 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D DF 6B 5E 26 43 12 DA 82 09 EA D4 93 5E E6 69"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hmwooYMM.exe" = "%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

The process %original file name%.exe:1384 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C F5 00 78 B7 01 FD 93 90 42 4E F6 5D 61 4A B5"

The process %original file name%.exe:176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 26 95 22 60 58 B0 F9 90 35 10 3A BA FE F3 91"

The process %original file name%.exe:1488 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 F4 5F 8C D9 01 89 0C EB 01 74 97 0B A2 ED 9F"

The process %original file name%.exe:172 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 5E 7D 9B 52 B3 42 26 AF 55 DE 35 F1 93 6E C2"

The process %original file name%.exe:220 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 30 D0 F4 99 ED 85 2A F5 AD E6 4D A0 1B AE 3E"

The process hmwooYMM.exe:1556 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 86 FE 47 97 6D EF 36 1B 3D AB 0A E2 C9 B8 73"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hmwooYMM.exe" = "%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe"

The process hEMQMIQs.exe:1472 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 A8 88 AC 51 F2 EB C7 F4 76 ED F2 92 C6 BD 0B"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

The process hEMQMIQs.exe:1848 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE AD F9 3E 20 26 D6 2C 38 3B A3 F8 09 6E C6 1B"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

Dropped PE files

MD5	File path
39e51884d3994956ff54d6814cf1f01c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
0731980480b293f889486c0458b7bd01	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
d3e83e6b1cd1ce3b893a595d9aed061b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
918845cdeed183fbccf72bc4f94521ef	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
f024b4daaaf761660179314831f7338c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
afaa2f79c7343113d140303471714434	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
ee4e5702dcc8ed11e561dd9bba1dcd9e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
64917db1c71d9c433bb6ed090394d00b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
f73ca06dcd92c05af6ea6e85d87bbd0b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
12f98fed1a00f02194d1178229bcb7d2	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
8b5559d43cd65c7f1f46830c03c33f57	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
6ee8dd8a601f1282156536f125c5c824	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
d4685389ce15589deeb39edc9daca7a7	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
503ac73cb253543c53cab6d481aaa8aa	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
8c1eb7a8d25afb559ba4230d4677f4f0	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
216555f1682c9414ea366d9fbbaead07	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
6e7b8f72e4b836984ae9d92e88b620d5	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
fc37168301859f07f1c8793693378d91	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
cc920cc19f818d602a2ab0757f3643f5	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
3b3f80d3b7653a8d2dbc9f545ef3ea1c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
ab75218431fc78b0224b26a52f361432	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
ca3bc49bf9a46352ef99d92f662494b8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
feb721d63a738104c1aa53ec8d4bec69	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
643fad029979477d3c03061d25a97c86	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
e80378fa4689d68ed37c8e37b0e676a3	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
a9789b2bc5dbd16622222c64671d8a4d	c:\Documents and Settings\All Users\JUsIccwo\hEMQMIQs.exe
aba74420acaf35f4cc9987ed98ae49ef	c:\Documents and Settings\All Users\xWAMIgUE\zuMEoUcg.exe
27faea7fdfaae24078bafdbbf7c49287	c:\Documents and Settings\"%CurrentUserName%"\tiMscAww\hmwooYMM.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
cscript.exe:604
cscript.exe:536
cscript.exe:1272
cscript.exe:336
cscript.exe:1136
cscript.exe:1988
cscript.exe:1920
cscript.exe:388
cscript.exe:240
cscript.exe:736
cscript.exe:1928
cscript.exe:980
%original file name%.exe:1176
%original file name%.exe:1828
%original file name%.exe:1284
%original file name%.exe:1272
%original file name%.exe:1712
%original file name%.exe:1956
%original file name%.exe:2020
%original file name%.exe:2004
%original file name%.exe:1384
%original file name%.exe:176
%original file name%.exe:1488
%original file name%.exe:172
%original file name%.exe:220
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\OCMMogQg.bat (4 bytes)
C:\1909e387c39f783e54afeb3025fe0e9c (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oiYUMsUs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VwoQYYQc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ceAkMQcg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eeggIkAY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bagEQEEY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VMUkQUsU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eKMkUsQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ziIIIEok.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OgQsEUAI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MccEIYUw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qIoYAgcY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OaAEoMwI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OicokQYk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DmIYwEYM.bat (4 bytes)
%Documents and Settings%\All Users\xWAMIgUE\zuMEoUcg.exe (7881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SGgUIgQk.bat (112 bytes)
%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe (7857 bytes)
%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe (7905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\keQkYAAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VSQUQcIc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eAYkIcYY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GCUEgwwo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pCowcYEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fWoAQsEM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XOIsoUkI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HSYQIAUs.bat (112 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\NAAo.txt (52690 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hmwooYMM.exe" = "%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	2940928	2937856	5.52804	4d49ed4dbddce51d2ceb1158fb3150d4
.rdata	2945024	4096	512	1.75565	e63533d4c3ab201743fa87dc9b9816bb
.data	2949120	5	512	0.070639	b34caf0de498c0dce0866041a7028448
.rsrc	2953216	4444	4608	3.23564	284e09bb64b61cea2d8c6f133b18c674

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	216.58.209.206

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=v0kWVcPqFYiu8wfCiQE

Content-Length: 259

Date: Sat, 28 Mar 2015 06:27:11 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=v0kWVcPqFYiu8wfCiQE">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=v0kWVcPqFYiu8wfCiQE..Content-Length: 259..Date: Sat, 28 Mar 2015 06:27:11 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=v0kWVcPqFYiu8wfCiQE">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=xEkWVfzKMaKt8we3h4CABQ

Content-Length: 262

Date: Sat, 28 Mar 2015 06:27:16 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=xEkWVfzKMaKt8we3h4CABQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=xEkWVfzKMaKt8we3h4CABQ..Content-Length: 262..Date: Sat, 28 Mar 2015 06:27:16 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=xEkWVfzKMaKt8we3h4CABQ">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=vUkWVdfVB46u8wealoDABA

Content-Length: 262

Date: Sat, 28 Mar 2015 06:27:09 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=vUkWVdfVB46u8wealoDABA">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=vUkWVdfVB46u8wealoDABA..Content-Length: 262..Date: Sat, 28 Mar 2015 06:27:09 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=vUkWVdfVB46u8wealoDABA">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

hmwooYMM.exe_1556:

.text

.rdata

@.data

b5.ug

.hFgU

.oe`"

t!.lN-=

t&t%xG

TcPoopUk

') 2ÃŸ

.xXlT '

A%fSx01/

-.xOf(

.Gr6nGTny

/T%x8f3x\

-Ã•O3C]i5

.lUnl

dxGjY4%x(

mNUk.xG

.Gm@tt

dFX.xG

C%uYlI

&%6XG

.Vk\.

k.qNk

%XmTgX

> %XUPC,i

'.Tf-

%X]Q|

.TV]S

P,n%S

rP[.wO

h`2%f%

fR[.wO

.FtjhY

S[.wg

.am$%

fR[.wN

v[[.wI

,[.wG

Uk!F%SEQF

4[.ww

.Al|3

x.pzNbR

fR[.wI

u[[.wI

E8[.wc

]%Cs,

fR[.wH

S[.wl

S[.wu

S[.wx

r/%u.

vQ[.wO

L.WZyu

L[.wl

p[.wu

b.Gr,.

L[.wz

S[.wz

f.KpV

D[.wu

w\[.wL

,[.ws

g%fxM1

,[.wt

fR[.wD

wS[.wJ

ZbXBSsh

|[.wv

P[.wH

U[.wI

wR[.wq

vQ[.wJ

fR[.wL

vV[.wI

-3%x(

l[.wc

|[.wq

cX.SA

*`.VR

S[.wv

,[.wv

R[.wO

L[.wN

e#.TP

,[.wz

Af%d

Q[.wH

wP[.ww

Z[.wy

L[.wv

S[.wp

uY[.wO

5"%xdF

w\[.wy

nP.BE

%co ,

2#C

iTCpb

l[.wv

.cqdT

4[.wc

H'%Uzo}m

&T.cp

b{y.xGy

v[[.wH

.Nfe`

wP[.wz

ht%F:jT

n\[.wy

tQ[.wH

,[.wb

{.lng

w\[.ww

6[.wt

,[.wl

3]9%UA{

,[.wu

p[[.wF

v4[.wG

pKt[.wK

p[.wp

5.fz%

V[.wH

l[.wq

sQ[.wH

w\[.wz

P[.wv

~j-2}|

T=.je2

;bG.YY|

fR[.wE

rU[.wG

/O[.wK

vL[.wG

e\[.wG

\[.wG

WwP[.wp

v".bBal

G;.eF

Microsoft Windows

reg.exe

c39f783e54afeb3025fe0e9c.exe

IVaO.RG

JnwO.Pd

ZwSaveMergedKeys

ntdll.dll

user32.dll

kernel32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global III is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

hmwooYMM.exe_1556_rwx_009A0000_00001000:

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

hEMQMIQs.exe_1472:

.text

.rdata

@.data

b5.ug

.hFgU

.oe`"

t!.lN-=

t&t%xG

TcPoopUk

') 2ÃŸ

.xXlT '

A%fSx01/

-.xOf(

.Gr6nGTny

/T%x8f3x\

-Ã•O3C]i5

.lUnl

dxGjY4%x(

mNUk.xG

.Gm@tt

dFX.xG

C%uYlI

&%6XG

.Vk\.

k.qNk

%XmTgX

> %XUPC,i

'.Tf-

%X]Q|

.TV]S

rP[.wO

h`2%f%

fR[.wO

.FtjhY

S[.wg

.am$%

fR[.wN

v[[.wI

,[.wG

Uk!F%SEQF

4[.ww

.Al|3

x.pzNbR

fR[.wI

u[[.wI

E8[.wc

]%Cs,

fR[.wH

S[.wl

S[.wu

S[.wx

r/%u.

vQ[.wO

L.WZyu

L[.wl

p[.wu

b.Gr,.

L[.wz

S[.wz

f.KpV

D[.wu

w\[.wL

,[.ws

g%fxM1

,[.wt

fR[.wD

wS[.wJ

ZbXBSsh

|[.wv

P[.wH

U[.wI

wR[.wq

vQ[.wJ

fR[.wL

vV[.wI

-3%x(

l[.wc

|[.wq

cX.SA

*`.VR

S[.wv

,[.wv

R[.wO

L[.wN

e#.TP

,[.wz

Af%d

Q[.wH

wP[.ww

Z[.wy

L[.wv

S[.wp

uY[.wO

5"%xdF

w\[.wy

nP.BE

%co ,

2#C

iTCpb

l[.wv

.cqdT

4[.wc

H'%Uzo}m

&T.cp

b{y.xGy

v[[.wH

.Nfe`

wP[.wz

ht%F:jT

n\[.wy

tQ[.wH

,[.wb

{.lng

w\[.ww

6[.wt

,[.wl

3]9%UA{

,[.wu

p[[.wF

v4[.wG

pKt[.wK

p[.wp

5.fz%

V[.wH

l[.wq

sQ[.wH

w\[.wz

P[.wv

~j-2}|

T=.je2

;bG.YY|

fR[.wE

rU[.wG

/O[.wK

vL[.wG

e\[.wG

\[.wG

WwP[.wp

v".bBal

Microsoft Windows

~.xtM

1t%UF

user32.dll

ole32.dll

NtSaveKey