Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\mzwpstr8n [milf] latex .rar.exe
- %ProgramFiles%\dvd maker\shared\asian 8ok6yf girls titts .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\8r3baiec bd1l5ir uncut (jenna).mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\yzw1afy mzwpstr8n big (36mho73,haj1oyikd).mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\8r3baiec wep6b08 apv53deiq9fw .mpeg.exe
- %ProgramFiles%\microsoft office\templates\ikdyfwhy gay horse uncut fishy (dehod0).rar.exe
- %ProgramFiles%\windows journal\templates\fac71w2 nude big (g6u8n4r,y8oxsqa).zip.exe
- %ProgramFiles%\windows sidebar\shared gadgets\f1i7cm nom72kl mnho9y54 nom72kl boobs (y8oxsqa,g6u8n4r).zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\s2fkave beast [milf] sm .rar.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\wpjwijv porn girls ae2sd7u4xh .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\tsomq34 lpcu5ai3 big .mpeg.exe
- %CommonProgramFiles(x86)%\microsoft shared\7b6fhxi tsomq34 nom72kl boots .rar.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\tsomq34 [milf] .zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\viaz50 lpcu5ai3 epyxwn .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\xxx nom72kl latex .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\z1qxwcd nom72kl [milf] b37oavmx289 .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\ikdyfwhy xxx apv53deiq9fw (36mho73,jenna).rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\z9z7rwe xxx ihthd33 eigt45 .rar.exe
- %ALLUSERSPROFILE%\templates\8ok6yf h93bklf uncut glans .mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\z1qxwcd h93bklf horse bq4kno feet (jade,jade).rar.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\h93bklf 8ok6yf hot (!) hole ejn547rbxhd1 .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\gzn4ud7e beast epyxwn 6tl9zg0uqa .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\sperm horse girls gsva2xn .rar.exe
- %ALLUSERSPROFILE%\templates\lpcu5ai3 [milf] 6tl9zg0uqa .mpeg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\7b6fhxi cum xakmpl nom72kl hole (sandy).avi.exe
- C:\users\default\appdata\local\temp\upfgetx mnho9y54 w6csjja14n1 epyxwn feet sm .mpeg.exe
- C:\users\default\appdata\local\<INETFILES>\z9z7rwe horse girls lady .avi.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\xakmpl [bangbus] feet sgoibhh .mpg.exe
- %LOCALAPPDATA%\<INETFILES>\z9z7rwe w6csjja14n1 nom72kl hole ae2sd7u4xh (y8oxsqa,sarah).zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\s2fkave nom72kl apv53deiq9fw (liz,dehod0).avi.exe
- %LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\fac71w2 lpcu5ai3 [milf] kfp2yqq fishy .rar.exe
- %LOCALAPPDATA%low\mozilla\temp-{3571406e-c08c-4c74-b145-8857b365f6e7}\fac71w2 nude 7vepaqjm glans (liz,c4w8hqa).mpeg.exe
- %APPDATA%\microsoft\templates\asian w6csjja14n1 nom72kl .avi.exe
- %APPDATA%\microsoft\windows\templates\ nude 7vepaqjm jxqgtp .zip.exe
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\wpjwijv w6csjja14n1 mnho9y54 7vepaqjm wifey .avi.exe
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\porn mzwpstr8n hot (!) gh5b6gd7wrv .mpeg.exe
- %HOMEPATH%\templates\horse beast big hole .mpeg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\upfgetx nom72kl horse girls jxqgtp .mpeg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\f1i7cm tsomq34 w6csjja14n1 l9hwcs7vvnphd9 .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\yzw1afy l9hwcs7vvnphd9 .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\4h1e2a346 nude h93bklf uncut glans .mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\bd1l5ir hot (!) feet (sonja).rar.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\f1i7cm bq4kno .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\gzn4ud7e xakmpl 7vepaqjm (jenna).mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\bd1l5ir horse big b37oavmx289 .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\s2fkave beast 8ok6yf uncut hole .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\7b6fhxi mzwpstr8n nom72kl big legs eigt45 .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\7nd83wovj ddqayq [bangbus] (dehod0,karin).avi.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\mnho9y54 vjq39c1gwy cock (hyo87il,gina).zip.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\viaz50 beast nom72kl epyxwn .mpg.exe
- %WINDIR%\assembly\temp\eq7k2xcxt gay beast l9hwcs7vvnphd9 .mpeg.exe
- %WINDIR%\assembly\tmp\zc8giv9 wep6b08 [bangbus] (y8oxsqa).mpg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\wep6b08 nude uncut nmibe2 .rar.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\wep6b08 l9hwcs7vvnphd9 .avi.exe
- %WINDIR%\pla\templates\horse uncut .rar.exe
- %WINDIR%\security\templates\nude mzwpstr8n epyxwn .mpg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\ikdyfwhy mnho9y54 [bangbus] .rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\z9z7rwe 8ok6yf h93bklf l9hwcs7vvnphd9 .mpg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\eq7k2xcxt 8ok6yf big fishy .avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\horse cum apv53deiq9fw 40+ .avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\8r3baiec gay ihthd33 boots (karin,c4w8hqa).zip.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\4h1e2a346 cum bq4kno 6tl9zg0uqa .zip.exe
- %WINDIR%\syswow64\config\systemprofile\jxaglwti gay horse sgu4m7oc .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\wpjwijv horse [milf] (dehod0,c4w8hqa).zip.exe
- %WINDIR%\syswow64\fxstmp\nude 8ok6yf nom72kl boobs (36mho73,gina).zip.exe
- %WINDIR%\syswow64\ime\shared\8r3baiec sperm l9hwcs7vvnphd9 eigt45 .avi.exe
- %WINDIR%\syswow64\config\systemprofile\7b6fhxi horse w6csjja14n1 epyxwn 40+ (rdl1tfkz).mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\0287zh horse 8ok6yf hot (!) .mpg.exe
- %WINDIR%\syswow64\ime\shared\eq7k2xcxt lpcu5ai3 7nd83wovj nom72kl sgoibhh .zip.exe
- %WINDIR%\temp\4h1e2a346 nom72kl nude girls 40+ .zip.exe
- %WINDIR%\winsxs\installtemp\zc8giv9 cum [free] titts fw58kpr41ob1w (sandy).mpg.exe
- <Current directory>\sqjaed7r1vnw
- %CommonProgramFiles%\microsoft shared\s2fkave sperm uncut sweet .mpeg.exe
- %ProgramFiles%\dvd maker\shared\wpjwijv beast [bangbus] (2hbt8wr).rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\4h1e2a346 bd1l5ir [milf] gsva2xn .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\7b6fhxi w6csjja14n1 yzw1afy apv53deiq9fw girly .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\4h1e2a346 porn porn apv53deiq9fw zn3tvn .mpeg.exe
- %ProgramFiles%\microsoft office\templates\beast apv53deiq9fw .avi.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\upfgetx w6csjja14n1 epyxwn .mpg.exe
- %ProgramFiles%\windows journal\templates\wpjwijv mzwpstr8n xakmpl uncut b37oavmx289 .zip.exe
- %ProgramFiles%\windows sidebar\shared gadgets\z9z7rwe mnho9y54 epyxwn b37oavmx289 (dxocjwba).mpeg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\horse 8ok6yf uncut (jade,rdl1tfkz).rar.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\s2fkave porn mnho9y54 uncut .zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\8r3baiec wep6b08 uncut boots .mpeg.exe
- %CommonProgramFiles(x86)%\microsoft shared\0287zh tsomq34 porn apv53deiq9fw 50+ (y8oxsqa,y8oxsqa).avi.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\yzw1afy ddqayq hot (!) nrb42wq .zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\f1i7cm mnho9y54 lpcu5ai3 7vepaqjm latex .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\beast w6csjja14n1 l9hwcs7vvnphd9 .mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\cum nom72kl .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\7nd83wovj beast hot (!) b37oavmx289 .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\black porn mzwpstr8n uncut cock girly .mpeg.exe
- %ALLUSERSPROFILE%\templates\jxaglwti cum big eigt45 .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\eq7k2xcxt xxx nude sgu4m7oc 779mipj .avi.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\bd1l5ir epyxwn sgoibhh .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\8ok6yf beast uncut boobs gsva2xn (g6u8n4r).avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\s2fkave wep6b08 gay epyxwn js80j73 .mpg.exe
- %ALLUSERSPROFILE%\templates\horse 7nd83wovj apv53deiq9fw qq6w54yfhtqrbwcslg .mpeg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\7b6fhxi mnho9y54 gay 7vepaqjm 50+ .rar.exe
- C:\users\default\appdata\local\temp\ beast [bangbus] .mpeg.exe
- C:\users\default\appdata\local\<INETFILES>\jxaglwti nude xakmpl apv53deiq9fw 8pfmdyy .mpg.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\cum uncut balls .mpeg.exe
- C:\users\default\templates\s2fkave porn [bangbus] 50+ .mpg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\eq7k2xcxt porn mzwpstr8n hot (!) .zip.exe
- %TEMP%\nude w6csjja14n1 epyxwn feet .mpg.exe
- %LOCALAPPDATA%\<INETFILES>\fac71w2 xxx uncut hotel (dxocjwba,hyo87il).avi.exe
- %LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\asian yzw1afy nom72kl jxqgtp js80j73 .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\w6csjja14n1 vjq39c1gwy hotel .rar.exe
- %LOCALAPPDATA%low\mozilla\temp-{3571406e-c08c-4c74-b145-8857b365f6e7}\8ok6yf sperm apv53deiq9fw .zip.exe
- %APPDATA%\microsoft\templates\eq7k2xcxt xakmpl 7nd83wovj hot (!) .mpg.exe
- %APPDATA%\microsoft\windows\templates\xxx apv53deiq9fw boobs gsva2xn .zip.exe
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\sperm [bangbus] ash sm .avi.exe
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\viaz50 cum lpcu5ai3 7vepaqjm fishy .mpg.exe
- %HOMEPATH%\templates\zc8giv9 gay girls kfp2yqq .zip.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\xxx 8ok6yf ihthd33 titts latex .avi.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\sperm horse hot (!) sm .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\lpcu5ai3 mzwpstr8n [bangbus] .rar.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\tsomq34 hot (!) ash hairy .mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\f1i7cm yzw1afy [bangbus] hole eigt45 .avi.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\f07qtt yzw1afy big 40+ .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\nude wep6b08 ihthd33 cock (g6u8n4r).avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\beast wep6b08 [milf] rv0y8n (c4w8hqa).rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\lpcu5ai3 mnho9y54 [bangbus] .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\mnho9y54 7vepaqjm .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\8r3baiec yzw1afy girls ash ae2sd7u4xh .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\s2fkave nom72kl sgu4m7oc cock shoes .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\z9z7rwe ddqayq uncut .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\horse nom72kl .zip.exe
- %WINDIR%\assembly\temp\porn [milf] ash boots .mpg.exe
- %WINDIR%\assembly\tmp\w6csjja14n1 apv53deiq9fw (36mho73).rar.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\h93bklf epyxwn .mpg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\bd1l5ir bd1l5ir big feet sm .mpg.exe
- %WINDIR%\pla\templates\ uncut ash .zip.exe
- %WINDIR%\security\templates\z9z7rwe horse yzw1afy 7vepaqjm .mpg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\cum uncut .rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\mzwpstr8n hot (!) (dxocjwba,y8oxsqa).rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\tsomq34 mnho9y54 hot (!) .mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\upfgetx beast [free] cock .mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\f1i7cm beast beast bq4kno feet 8pfmdyy .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\0287zh horse [bangbus] .zip.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\gzn4ud7e girls .avi.exe
- %WINDIR%\syswow64\fxstmp\cum mnho9y54 ihthd33 cock balls (36mho73).mpg.exe
- %WINDIR%\syswow64\ime\shared\gzn4ud7e wep6b08 mnho9y54 uncut girly .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\beast bq4kno zmc8ujp (karin).avi.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\porn 8ok6yf [free] .mpg.exe
- %WINDIR%\syswow64\fxstmp\horse apv53deiq9fw titts gh5b6gd7wrv .avi.exe
- %WINDIR%\syswow64\ime\shared\asian beast h93bklf [milf] (jade,sarah).mpeg.exe
- %WINDIR%\temp\xxx horse [free] qx2j1b5 (sonja,g6u8n4r).mpeg.exe
- %WINDIR%\winsxs\installtemp\7b6fhxi sperm vjq39c1gwy b37oavmx289 .zip.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
