Disagree with this determination?
Associated Malware Groups
The filename is associated with the malware group:
File Behavior
RENO0002.EXE has been seen to perform the following behavior:
- Uses hidden browser windows to connect to web sites without telling you
- Runs Javascript code
- Visits web sites on your PC without you knowing
- Creates system tray popups, messages, errors and security warnings
- Opens browser pop ups
- Uses DNS to retrieve the IP address for web sites
RENO0002.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Executed as a Process
Country Of Origin
The filename RENO0002.EXE was first seen on May 31 2009 in the following geographical region of the Prevx community:
File Name Aliases
RENO0002.EXE can also use the following file names:
- 86123815.EXE
- 1629.EXE
- 5568.EXE
- 51799076.EXE
- 1.TMP.EXE
Filesizes
This file has been seen with the following file size:
Vendor, Product and Version Information
This file has no vendor, product or version information specified in the file header.
File Type
The filename RENO0002.EXE refers to an executable program.
File Activity
One or more files with the name RENO0002.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\windows\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
- Opens/modifes c:\autoexec.bat
Registry Activity
One or more files with the name RENO0002.EXE creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Cognac C:\8886286.exe
- HKEY_CURRENT_USER\Software\Cognac s00000000
- HKEY_CURRENT_USER\Software\Cognac s00000001
- HKEY_CURRENT_USER\Software\Cognac d00000004 [REG_DWORD, value: 00015180]
- HKEY_CURRENT_USER\Software\Cognac d00000005 value:
- HKEY_CURRENT_USER\Software\Cognac d00000002 [REG_DWORD, value: 01C9F3AE]
- HKEY_CURRENT_USER\Software\Cognac d00000003 [REG_DWORD, value: 7A72C210]
- HKEY_CURRENT_USER\Software\Cognac d00000006 value:
- HKEY_CURRENT_USER\Software\Cognac s00000002
- HKEY_CURRENT_USER\Software\Cognac d00000005 value:
- HKEY_CURRENT_USER\Software\Cognac d00000000 [REG_DWORD, value: 01C9F2E5]
- HKEY_CURRENT_USER\Software\Cognac d00000001 [REG_DWORD, value: 61D52140]
- HKEY_CURRENT_USER\Software\Cognac d00000001 [REG_DWORD, value: 6E5BEAC0]
Network Activity
One or more files with the name RENO0002.EXE performs the following network events:
- DNS Lookup imagesrepository.com
- DNS Lookup216.240.157.91 imagesrepository.com
- DNS Lookup delphiner.com
- DNS Lookup94.75.207.219 delphiner.com
- DNS Lookup127.0.0.1 0
- DNS Lookup68.169.70.134 68.169.70.134
- DNS Lookup www.abcjmp.com
- DNS Lookup67.29.139.153 www.abcjmp.com
- DNS Lookup www.abcsearch.com
- DNS Lookup67.29.139.199 www.abcsearch.com
- DNS Lookup www.filmannex.com
- DNS Lookup64.130.21.220 www.filmannex.com
- DNS Lookup www2.filmannex.com
- DNS Lookup64.130.43.157 www2.filmannex.com
- DNS Lookup www.google-analytics.com
- DNS Lookup74.125.95.102 www.google-analytics.com
- DNS Lookup redir.adap.tv
- DNS Lookup68.142.122.70 redir.adap.tv
- DNS Lookup static.ak.connect.facebook.com
- DNS Lookup74.203.241.8 static.ak.connect.facebook.com
- DNS Lookup media.scanscout.com
- DNS Lookup74.203.241.10 media.scanscout.com
Website Activity
One or more files with the name RENO0002.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- Remote server connection to imagesrepository .co
- Remote server connection to delphiner .co
- Remote server connection to 68 .169 .70 .13
- Remote server connection to www .abcjmp .co
- Remote server connection to www .abcsearch .co
- Remote server connection to www .filmannex .co
- Remote server connection to www2 .filmannex .co
- Remote server connection to www .google-analytics .co
- Remote server connection to redir .adap .t
- Remote server connection to static .ak .connect .facebook .co
- Remote server connection to media .scanscout .co
- TCP:127.0.0.1:1072 Port:24
- Port 80 IP:216.240.157.91
- Port 80 IP:94.75.207.219
- Port 80 IP:68.169.70.134
- Port 80 IP:67.29.139.153
- Port 80 IP:67.29.139.199
- Port 80 IP:64.130.21.220
- Port 80 IP:64.130.43.157
- Port 80 IP:74.125.95.102
- Port 80 IP:68.142.122.70
- Port 80 IP:74.203.241.8
- Port 80 IP:74.203.241.10