Pwdump

When the program executes it connects to a remote computer and downloads the following file:
pwdservice.exe

Next, the program registers the downloaded file as a remote service.

The program creates the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer\"000" = "pwdservice.exe"

The program then sends extracted password hashes to a remote computer.

Summary