CCN27.EXE – Unknown removal

CCN27.EXE size: 94416 bytes
CCN27.EXE hash: 01B1BF905BF232162615EB4B57ADBC8A

Created files:

%Program Files%\MSN Gaming Zone\Windows\bckgzm.exe
%Program Files%\MSN Gaming Zone\Windows\chkrzm.exe
%Program Files%\NetMeeting\conf.nbj
%Program Files%\Windows NT\dialer.gvm
%Program Files%\Yi21.exe
%SysDir%\Winktmt.exe
%TEMP%\Ccn27.exe
%TEMP%\Dgl26.exe
%TEMP%\Lk22.exe
%TEMP%\Lol24.exe
%TEMP%\Mjp25.exe
%TEMP%\Na23.exe
\\VBOXSVR\in\Hfbb.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\S9t6CLp\Type: 10010000
HKLM\System\CurrentControlSet\Services\S9t6CLp\Start: 03000000
HKLM\System\CurrentControlSet\Services\S9t6CLp\DisplayName: S9t6CLp
HKLM\System\CurrentControlSet\Services\S9t6CLp\ImagePath: \\VBOXSVR\in\Hfbb.exe
HKLM\System\CurrentControlSet\Services\Winktmt\Type: 10010000
HKLM\System\CurrentControlSet\Services\Winktmt\Start: 02000000
HKLM\System\CurrentControlSet\Services\Winktmt\DisplayName: Winktmt
HKLM\System\CurrentControlSet\Services\Winktmt\ImagePath: %WinDir%\System32\Winktmt.exe

Detected by UnHackMe:

CCN27.EXE
Default location: %TEMP%\CCN27.EXE

Dropper information:
MD5: 072c284f8c4ceaef0bad56759965f8e4
File size: 95740 bytes