Gen.Variant.Kazy.535449_1b5f3d7ec4 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:1788
cscript.exe:1304
cscript.exe:1140
cscript.exe:1300
cscript.exe:228
cscript.exe:132
cscript.exe:492
cscript.exe:1836
cscript.exe:1076
cscript.exe:1220
cscript.exe:544
cscript.exe:280
cscript.exe:548
cscript.exe:348
cscript.exe:284
cscript.exe:816
cscript.exe:408
cscript.exe:1796
cscript.exe:260
cscript.exe:268
cscript.exe:364
cscript.exe:1824
cscript.exe:1064
cscript.exe:928
cscript.exe:1388
cscript.exe:644
cscript.exe:1080
cscript.exe:1328
cscript.exe:984
cscript.exe:1484
cscript.exe:1256
cscript.exe:1252
cscript.exe:1016
cscript.exe:1236
cscript.exe:1336
cscript.exe:304
cscript.exe:244
cscript.exe:240
cscript.exe:900
cscript.exe:1432
cscript.exe:1840
cscript.exe:1648
cscript.exe:1532
cscript.exe:516
cscript.exe:1224
cscript.exe:624
cscript.exe:1228
cscript.exe:1908
cscript.exe:252
cscript.exe:256
cscript.exe:1632
cscript.exe:972
cscript.exe:852
cscript.exe:1032
cscript.exe:188
cscript.exe:636
cscript.exe:1352
cscript.exe:1864
cscript.exe:1592
cscript.exe:220
cscript.exe:868
cscript.exe:1996
cscript.exe:1028
cscript.exe:1748
cscript.exe:1672
cscript.exe:1452
cscript.exe:1976
cscript.exe:728
cscript.exe:1512
cscript.exe:1164
cscript.exe:156
cscript.exe:1972
cscript.exe:1052
cscript.exe:1968
cscript.exe:1056
cscript.exe:356
cscript.exe:1964
cscript.exe:1568
cscript.exe:2036
cscript.exe:2032
cscript.exe:1116
cscript.exe:1244
cscript.exe:1176
cscript.exe:776
cscript.exe:612
cscript.exe:1272
cscript.exe:1276
cscript.exe:1888
cscript.exe:1608
cscript.exe:1040
cscript.exe:948
cscript.exe:1600
cscript.exe:1288
cscript.exe:1680
cscript.exe:1956
cscript.exe:1688
cscript.exe:1368
cscript.exe:804
%original file name%.exe:1304
%original file name%.exe:1788
%original file name%.exe:1140
%original file name%.exe:1300
%original file name%.exe:1780
%original file name%.exe:132
%original file name%.exe:492
%original file name%.exe:1256
%original file name%.exe:1776
%original file name%.exe:1076
%original file name%.exe:1376
%original file name%.exe:280
%original file name%.exe:348
%original file name%.exe:284
%original file name%.exe:1672
%original file name%.exe:408
%original file name%.exe:1796
%original file name%.exe:260
%original file name%.exe:268
%original file name%.exe:928
%original file name%.exe:1388
%original file name%.exe:828
%original file name%.exe:1328
%original file name%.exe:984
%original file name%.exe:1480
%original file name%.exe:1484
%original file name%.exe:792
%original file name%.exe:1524
%original file name%.exe:520
%original file name%.exe:368
%original file name%.exe:364
%original file name%.exe:1236
%original file name%.exe:1336
%original file name%.exe:304
%original file name%.exe:380
%original file name%.exe:244
%original file name%.exe:240
%original file name%.exe:2040
%original file name%.exe:1932
%original file name%.exe:1840
%original file name%.exe:1240
%original file name%.exe:644
%original file name%.exe:1936
%original file name%.exe:1224
%original file name%.exe:1220
%original file name%.exe:1908
%original file name%.exe:256
%original file name%.exe:1900
%original file name%.exe:1632
%original file name%.exe:972
%original file name%.exe:1988
%original file name%.exe:1500
%original file name%.exe:1032
%original file name%.exe:188
%original file name%.exe:632
%original file name%.exe:636
%original file name%.exe:1352
%original file name%.exe:1860
%original file name%.exe:1596
%original file name%.exe:228
%original file name%.exe:1028
%original file name%.exe:1748
%original file name%.exe:816
%original file name%.exe:1452
%original file name%.exe:728
%original file name%.exe:1512
%original file name%.exe:1160
%original file name%.exe:1168
%original file name%.exe:1052
%original file name%.exe:1056
%original file name%.exe:1536
%original file name%.exe:1196
%original file name%.exe:1568
%original file name%.exe:2036
%original file name%.exe:320
%original file name%.exe:1112
%original file name%.exe:2032
%original file name%.exe:1532
%original file name%.exe:1176
%original file name%.exe:776
%original file name%.exe:612
%original file name%.exe:1276
%original file name%.exe:1888
%original file name%.exe:1608
%original file name%.exe:1040
%original file name%.exe:1976
%original file name%.exe:1972
%original file name%.exe:940
%original file name%.exe:356
%original file name%.exe:1956
%original file name%.exe:476
%original file name%.exe:2004
%original file name%.exe:2008
%original file name%.exe:1368
%original file name%.exe:804

The Trojan injects its code into the following process(es):

NesIMIQs.exe:848
fGAwoYMM.exe:224
reIEcoQI.exe:388

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process fGAwoYMM.exe:224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (7726 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (2321 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (30812 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (2321 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (3073 bytes)
C:\totalcmd\TCUNINST.EXE.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (3361 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (3073 bytes)
C:\totalcmd\TCMDX32.EXE.exe (3361 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (3073 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (3361 bytes)
C:\totalcmd\TcUsbRun.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (5441 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (2321 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process %original file name%.exe:1304 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kEoUcIoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oCkYoQoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZscEsEoM.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\euQEMQoY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TWwowggc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bcMwYUco.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oOMUEIYk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\suwwMkMo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bcMwYUco.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oOMUEIYk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oCkYoQoY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZscEsEoM.bat (0 bytes)

The process %original file name%.exe:1788 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pqcowwsk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TwEcoMwU.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eaUYUEoU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEQAsEIk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lygQUUoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YeAscAgw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BEQAsEIk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TwEcoMwU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eaUYUEoU.bat (0 bytes)

The process %original file name%.exe:1140 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sUwIwIcY.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\resQMMUU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sUwIwIcY.bat (0 bytes)

The process %original file name%.exe:1300 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iCgUgwIo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FwQscIYM.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MugAQgoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xCcQwgkw.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MugAQgoY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xCcQwgkw.bat (0 bytes)

The process %original file name%.exe:1780 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TisQQQMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JmswIswU.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EaMIcoQg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\faAMUYMg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xksMAssM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JwoYIoAA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JmswIswU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JwoYIoAA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xksMAssM.bat (0 bytes)

The process %original file name%.exe:132 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HkkAIcYo.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OmQMwIsA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HkkAIcYo.bat (0 bytes)

The process %original file name%.exe:492 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\omQEEYkI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kKwQAcwQ.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CukgYgYY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YCIcAEgU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DoowIkYk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yIockoEc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kKwQAcwQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yIockoEc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YCIcAEgU.bat (0 bytes)

The process %original file name%.exe:1256 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZMsoUcgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aSIEYkMc.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZMsoUcgA.bat (0 bytes)

The process %original file name%.exe:1776 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NqwAsoMg.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (3849 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (3849 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RYgsMkQk.bat (112 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (3729 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NqwAsoMg.bat (0 bytes)

The process %original file name%.exe:1076 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JIUksscY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gIUIsgQI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\twggEQQg.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bQswkEwM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JIUksscY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\twggEQQg.bat (0 bytes)

The process %original file name%.exe:1376 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GGoYYIcM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MeoUIQIo.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GGoYYIcM.bat (0 bytes)

The process %original file name%.exe:280 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\smsUEoMM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VMUIosAs.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DsUckUQA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZwQkgkkY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VMUIosAs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DsUckUQA.bat (0 bytes)

The process %original file name%.exe:348 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oMwgIwso.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\luQMcogc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NqIUEUMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RYcEkoMY.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KccoQkYw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nCMEYwck.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QKYkoUAI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jQwgogYw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TMQkcwAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fEMUAAUA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oMwgIwso.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KccoQkYw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\luQMcogc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NqIUEUMs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jQwgogYw.bat (0 bytes)

The process %original file name%.exe:284 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IWwcgkcQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cKIUMEUo.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IWwcgkcQ.bat (0 bytes)

The process %original file name%.exe:1672 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QYsAUYUM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lcAYoksY.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QYsAUYUM.bat (0 bytes)

The process %original file name%.exe:408 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cgIQAocM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PWwkMMoE.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IgsMcEwk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FicwwcgE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IgsMcEwk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FicwwcgE.bat (0 bytes)

The process %original file name%.exe:1796 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TqkQcMUc.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zaQYEwwA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gCsAsskY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AOYIwMMg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isckMIsU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EmMcIkgc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gCsAsskY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EmMcIkgc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zaQYEwwA.bat (0 bytes)

The process %original file name%.exe:260 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VsIMUcoA.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jyUkskwI.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VsIMUcoA.bat (0 bytes)

The process %original file name%.exe:268 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KgAAMgsE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kCcwIYMA.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VisAsIAY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hKYkwgwQ.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KgAAMgsE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VisAsIAY.bat (0 bytes)

The process %original file name%.exe:928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JgAQcMYc.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gcYEQssc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JgAQcMYc.bat (0 bytes)

The process %original file name%.exe:1388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iwEoYwoQ.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BoMAcMEA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BoMAcMEA.bat (0 bytes)

The process %original file name%.exe:828 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XiMgIIYI.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TgEcgwoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sksYYcoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xaAgYocA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TgEcgwoA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sksYYcoA.bat (0 bytes)

The process %original file name%.exe:1328 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DUUAsckE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cEgUkgQk.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cEgUkgQk.bat (0 bytes)

The process %original file name%.exe:984 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DsMEwUUk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cSkEAcEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gcAEUkgE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KWEggQMc.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\puEgEsMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmQoUQwQ.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cSkEAcEg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gcAEUkgE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\puEgEsMo.bat (0 bytes)

The process %original file name%.exe:1480 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cwMUQsoI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YYMsAQsI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gqcIMMYM.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qQckAckw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cwMUQsoI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gqcIMMYM.bat (0 bytes)

The process %original file name%.exe:1484 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ryAYkcAM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QSwUAwIM.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uWIMosEM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QQkwkAos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CUIIUEsI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DAIksook.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FYwEMcgE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\veIsQAQg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GWkoAwww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hKcsQkYA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\veIsQAQg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GWkoAwww.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CUIIUEsI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QSwUAwIM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hKcsQkYA.bat (0 bytes)

The process %original file name%.exe:792 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\siQMMYQo.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lWwoUQEw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\siQMMYQo.bat (0 bytes)

The process %original file name%.exe:1524 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CqMYogsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jqIoIIos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PmkYQUwE.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeosckgI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XSwcIQQI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sIMcEcko.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XSwcIQQI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sIMcEcko.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PmkYQUwE.bat (0 bytes)

The process %original file name%.exe:520 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VcwoAsME.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NWMgYQAg.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VcwoAsME.bat (0 bytes)

The process %original file name%.exe:368 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZoEocwcM.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YYEMcQUA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SmgYQEMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zEEAkEQU.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SmgYQEMs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zEEAkEQU.bat (0 bytes)

The process %original file name%.exe:364 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YoEYowMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zWYsAUIs.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\muMQQcwQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pIwIkMIE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\muMQQcwQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pIwIkMIE.bat (0 bytes)

The process %original file name%.exe:1236 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cMEAcwkI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wgsQQYYs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oQsQUcgc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UsUkwYwQ.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oQsQUcgc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UsUkwYwQ.bat (0 bytes)

The process %original file name%.exe:1336 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GQEYcQcg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IckAIQEE.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AIgIosks.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\akkYcAUQ.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GQEYcQcg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\akkYcAUQ.bat (0 bytes)

The process %original file name%.exe:304 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fQIwYQEI.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FEQUsckg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AyYYUkMA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWEsEIgE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AyYYUkMA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWEsEIgE.bat (0 bytes)

The process %original file name%.exe:380 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tiAsYgcc.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FkEsgMoc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FkEsgMoc.bat (0 bytes)

The process %original file name%.exe:244 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FIYwwMso.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QMosYssA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YkskEwks.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YSgwYoMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iqcgQgcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MsgsQoUk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XyQQMQMQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ncosoIoo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ncosoIoo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MsgsQoUk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YSgwYoMs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XyQQMQMQ.bat (0 bytes)

The process %original file name%.exe:240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VagcAMMc.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EEcQkAIs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EEcQkAIs.bat (0 bytes)

The process %original file name%.exe:2040 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eIcsEAAU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dAIQIUog.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MKgYgooQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TkskIccM.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TkskIccM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MKgYgooQ.bat (0 bytes)

The process %original file name%.exe:1932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\csYkYwwo.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pqIEYoIw.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pqIEYoIw.bat (0 bytes)

The process %original file name%.exe:1840 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vcwosQsM.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wikUAQAc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vcwosQsM.bat (0 bytes)

The process %original file name%.exe:1240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nUcAEgkk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\koQgAEEM.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\koQgAEEM.bat (0 bytes)

The process %original file name%.exe:644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uYgMkIcM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gOcQEMoA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gOcQEMoA.bat (0 bytes)

The process %original file name%.exe:1936 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YsAoAEYw.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gsIccUEw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YsAoAEYw.bat (0 bytes)

The process %original file name%.exe:1224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LeEgwMYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JgYMYMgk.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LeEgwMYs.bat (0 bytes)

The process %original file name%.exe:1220 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SkgsAAYA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xKYowEAU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IuMswMkE.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vsMIsUAs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SkgsAAYA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IuMswMkE.bat (0 bytes)

The process %original file name%.exe:1908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mGkIEUMI.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vywIkcYc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mGkIEUMI.bat (0 bytes)

The process %original file name%.exe:256 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RYkYcQss.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vywIIEcU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RYkYcQss.bat (0 bytes)

The process %original file name%.exe:1900 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OAAQIgsY.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AywkosoQ.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OAAQIgsY.bat (0 bytes)

The process %original file name%.exe:1632 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AsUoYQQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gUskQEUU.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BYgcwcww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PKQsEwEQ.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BYgcwcww.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PKQsEwEQ.bat (0 bytes)

The process %original file name%.exe:972 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CMMYkQEY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iSAMAIwE.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CMMYkQEY.bat (0 bytes)

The process %original file name%.exe:1988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jmUEIoAc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\igkMkkwE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LswsMgQM.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CsQIwAkw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jmUEIoAc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\igkMkkwE.bat (0 bytes)

The process %original file name%.exe:1500 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iyYswUww.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bOcEkIoM.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kyUIogUo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cwckwwQM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CagIUkws.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oOsowgMY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oOsowgMY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kyUIogUo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bOcEkIoM.bat (0 bytes)

The process %original file name%.exe:1032 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MaAoIQYc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fsIMgIEo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MaAoIQYc.bat (0 bytes)

The process %original file name%.exe:188 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uiYYwIcY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lAMkUgUQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeYoQYAo.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XKUUwksc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIosMwgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cOoMoIIw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uiYYwIcY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeYoQYAo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIosMwgA.bat (0 bytes)

The process %original file name%.exe:632 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vIcIgkMc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aGgQoosI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RaoIwMgI.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TIgUcYkc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aGgQoosI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TIgUcYkc.bat (0 bytes)

The process %original file name%.exe:636 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zAcQoMUM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ooMskUEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cYsYQYwY.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sgsMkgEY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ReIUIoIM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iisYgkgs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sgsMkgEY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cYsYQYwY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ooMskUEw.bat (0 bytes)

The process %original file name%.exe:1352 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GsoQgUQI.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zwEwkQII.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zwEwkQII.bat (0 bytes)

The process %original file name%.exe:1860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aKwsEEMw.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GgEYQgAs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GgEYQgAs.bat (0 bytes)

The process %original file name%.exe:1596 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JWsQgwYs.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fEosYcso.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JWsQgwYs.bat (0 bytes)

The process %original file name%.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qEQIMIQM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PgsgMocw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BOkUwcAc.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PgsgMocw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BOkUwcAc.bat (0 bytes)

The process %original file name%.exe:1028 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PQMIAIkM.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lOcscwUI.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lOcscwUI.bat (0 bytes)

The process %original file name%.exe:1748 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KEgEgIgw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rAUIMAkI.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KEgEgIgw.bat (0 bytes)

The process %original file name%.exe:816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DSAckAUQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WOUwccgE.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gsQwowwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CyMIsowo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fqccoEgs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BAgoIkEE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DSAckAUQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CyMIsowo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BAgoIkEE.bat (0 bytes)

The process %original file name%.exe:1452 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YqoIYEIg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YQcMIYgo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YqoIYEIg.bat (0 bytes)

The process %original file name%.exe:728 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fAsogQsM.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\euUYEwsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mwsMoEUs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QyYoIMck.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MmcAUoIM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fWEUYUIs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\POEwIQUU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nAEQQUow.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MmcAUoIM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nAEQQUow.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fWEUYUIs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\POEwIQUU.bat (0 bytes)

The process %original file name%.exe:1512 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WGsckIMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VUYUskwY.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TIYMYAMQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hQIQYwAE.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VUYUskwY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TIYMYAMQ.bat (0 bytes)

The process %original file name%.exe:1160 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QwssswoI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\POcIsYok.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JgUggIws.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BGAIEAIM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tuMgIcEA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIUIMIwc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BGAIEAIM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIUIMIwc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tuMgIcEA.bat (0 bytes)

The process %original file name%.exe:1168 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GYcwwYQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KKQMAgQg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ygMAscAY.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xoUoocoU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KKQMAgQg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ygMAscAY.bat (0 bytes)

The process %original file name%.exe:1052 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hEcsAkEs.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NcwcoUEU.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NcwcoUEU.bat (0 bytes)

The process %original file name%.exe:1056 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\COEQAgMk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aOwYsYwg.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oGkgYsow.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GkYEQMQA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vYsYEUwM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\woYoAIEU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vYsYEUwM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GkYEQMQA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oGkgYsow.bat (0 bytes)

The process %original file name%.exe:1536 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CEAMcYEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IGMIcUQc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hQQcsgAQ.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wCIIIgoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\diUMwEwE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PKwIswMo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IGMIcUQc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hQQcsgAQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PKwIswMo.bat (0 bytes)

The process %original file name%.exe:1196 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gQgYEIog.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NuIcQUAM.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NuIcQUAM.bat (0 bytes)

The process %original file name%.exe:1568 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JQMkUkAY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lKIQAcII.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lKIQAcII.bat (0 bytes)

The process %original file name%.exe:2036 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kEQQkocg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KeQYswAY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KeQYswAY.bat (0 bytes)

The process %original file name%.exe:320 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pOcEgcok.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BywcUEEw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iYgooQEM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PsIEEkEQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qkMkYocs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DcUUEAcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bGgkkQII.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeEQIgws.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pOcEgcok.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PsIEEkEQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qkMkYocs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeEQIgws.bat (0 bytes)

The process %original file name%.exe:1112 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lsgkQccQ.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MkUIMMok.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lsgkQccQ.bat (0 bytes)

The process %original file name%.exe:2032 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uiQMMEAE.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OIkUcwQc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OIkUcwQc.bat (0 bytes)

The process %original file name%.exe:1532 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OmAcAksY.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LqUMwwIc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dEkkkYYo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gMkEcAws.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mcAIoIQI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bskUEEgs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bskUEEgs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OmAcAksY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dEkkkYYo.bat (0 bytes)

The process %original file name%.exe:1176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cMUkgUgU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EqMgMMEs.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cMUkgUgU.bat (0 bytes)

The process %original file name%.exe:776 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AUkoIcQo.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ckMUYQUg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AUkoIcQo.bat (0 bytes)

The process %original file name%.exe:612 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qickcoUk.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KscEQwkA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qickcoUk.bat (0 bytes)

The process %original file name%.exe:1276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sSYEcccc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HacoUwEw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sSYEcccc.bat (0 bytes)

The process %original file name%.exe:1888 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dAYoQAog.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dMYEwoYM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dAYoQAog.bat (0 bytes)

The process %original file name%.exe:1608 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FEwUEsko.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tyMwYcMk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hqUMAEsU.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BAMQIgsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wicUEIkU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RwYUAkwg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wicUEIkU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tyMwYcMk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RwYUAkwg.bat (0 bytes)

The process %original file name%.exe:1040 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vEgQkQYk.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xmwksogg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vEgQkQYk.bat (0 bytes)

The process %original file name%.exe:1976 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dysgkMQI.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SsAIgkoA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dysgkMQI.bat (0 bytes)

The process %original file name%.exe:1972 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YYUEoYcU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QmwYowUc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CSAkQYoo.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsMIscUw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\euwMEMAg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sWccAsIg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IEcgYsME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yCwsYIMs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YYUEoYcU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsMIscUw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CSAkQYoo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sWccAsIg.bat (0 bytes)

The process %original file name%.exe:940 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\egcEMUQY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nQkQsowg.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nQkQsowg.bat (0 bytes)

The process %original file name%.exe:356 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\resoIMQU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rgMAgUsM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\resoIMQU.bat (0 bytes)

The process %original file name%.exe:1956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ikIAAssc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QAUckcMw.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ikIAAssc.bat (0 bytes)

The process %original file name%.exe:476 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uicgMEcg.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YawUIYEI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CyQgAwQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gGowggwc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SUkUQMwI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vQIgMYQY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PyEUosQg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SsYkkoIQ.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PyEUosQg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SUkUQMwI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SsYkkoIQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CyQgAwQY.bat (0 bytes)

The process %original file name%.exe:2004 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OMoYsMMQ.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PekMUkQQ.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OMoYsMMQ.bat (0 bytes)

The process %original file name%.exe:2008 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PSoMsoYM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ygYEgYgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ikcYEEkY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eokUIEoM.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ygYEgYgk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eokUIEoM.bat (0 bytes)

The process %original file name%.exe:1368 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HiUkYQws.bat (112 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\niUIUgss.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\niUIUgss.bat (0 bytes)

The process %original file name%.exe:804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YGQIsAkU.bat (4 bytes)
C:\1b5f3d7ec4d42af993f9bbf6ae333813 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MgoswsIE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ASgEkkgU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PqQkYwMc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YGQIsAkU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ASgEkkgU.bat (0 bytes)

Registry activity

The process NesIMIQs.exe:848 makes changes in the system registry.