ROLLINGPOP_E.EXE – Trojan BadReputation removal

ROLLINGPOP_E.EXE size: 270192 bytes
ROLLINGPOP_E.EXE hash: 23120FE470BDAB085478D85DC05F5C88

Created files:

%SysDir%\Base64.dll
%AppData%\RollingPop\NTVBSvc.tlb
%AppData%\RollingPop\RollingPop_E.exe
%AppData%\RollingPop\RollingPop_R.exe
%AppData%\RollingPop\RollingPop_S.exe
%AppData%\RollingPop\RollingPop_U.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\RollingPop_Service\Type: 10000000
HKLM\System\CurrentControlSet\Services\RollingPop_Service\Start: 02000000
HKLM\System\CurrentControlSet\Services\RollingPop_Service\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\RollingPop_Service\DisplayName: RollingPop_Service
HKLM\System\CurrentControlSet\Services\RollingPop_Service\ImagePath: %WinDir%\System32\config\Systemprofile\Application Data\RollingPop\RollingPop_S.exe ROLL05
HKLM\System\CurrentControlSet\Services\RollingPop_Service\ObjectName: LocalSystem

Detected by UnHackMe:

ROLLINGPOP_E.EXE
Default location: %APPDATA%\ROLLINGPOP\ROLLINGPOP_E.EXE

Dropper information:
MD5: 565aec3aaac9ffd77c71eb7fabe2d03b
File size: 1251200 bytes