Files created:
C:\Documents and Settings\Admin\Local Settings\Temp\aA92E.tmp
C:\Documents and Settings\All Users\Application Data\<RandomName> (Example: nI19600AiOdB19600)
C:\Documents and Settings\All Users\Application Data\<RandomName>\<RandomName>
C:\Documents and Settings\All Users\Application Data\<RandomName>\<RandomName>.exe
Register changed:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce "<RandomName>" = "C:\Documents and Settings\All Users\Application Data\<RandomName>\<RandomName>.exe"
