Once launched, the Trojan extracts a file called “cmdno.exe” from its body to the Windows directory:
This file is 302594 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-PSW.Win32.QQRob.km.
This file will then be launched for execution.
The Trojan also causes the following image to be displayed: