Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\black yzw1afy big ash (gina,y8oxsqa).mpg.exe
- %ProgramFiles%\dvd maker\shared\zc8giv9 8ok6yf 7vepaqjm lady .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\ [bangbus] (haj1oyikd).mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\beast porn nom72kl cock .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\f07qtt horse lpcu5ai3 [free] sgoibhh (sonja).avi.exe
- %ProgramFiles%\microsoft office\templates\z9z7rwe gay wep6b08 bq4kno fishy .mpg.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\7nd83wovj big qq6w54yfhtqrbwcslg .avi.exe
- %ProgramFiles%\windows journal\templates\gzn4ud7e mnho9y54 [bangbus] .mpeg.exe
- %ProgramFiles%\windows sidebar\shared gadgets\s2fkave xakmpl nude l9hwcs7vvnphd9 hole .rar.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\black gay nom72kl jxqgtp js80j73 .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\xxx mnho9y54 vjq39c1gwy glans fw58kpr41ob1w .zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\0287zh bq4kno cock b37oavmx289 (sonja).mpeg.exe
- %CommonProgramFiles(x86)%\microsoft shared\upfgetx cum ddqayq uncut zn3tvn (y8oxsqa).zip.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\gzn4ud7e w6csjja14n1 vjq39c1gwy (haj1oyikd,haj1oyikd).zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\wpjwijv ddqayq big ol6p1tua (g6u8n4r).zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\asian w6csjja14n1 h93bklf [free] sm .mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\eq7k2xcxt girls nrb42wq .zip.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\viaz50 bd1l5ir yzw1afy big 8bgkvshe1 .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\7b6fhxi cum nom72kl 8bgkvshe1 (2hbt8wr,karin).mpeg.exe
- %ALLUSERSPROFILE%\templates\nude big (y8oxsqa,rdl1tfkz).mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\gay [milf] ejn547rbxhd1 .rar.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\z1qxwcd 7nd83wovj wep6b08 ihthd33 kfp2yqq .zip.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\zc8giv9 cum sperm epyxwn .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\gzn4ud7e xakmpl w6csjja14n1 [free] young (2hbt8wr,jade).avi.exe
- %ALLUSERSPROFILE%\templates\8r3baiec horse sgu4m7oc boobs sm .mpg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\wep6b08 wep6b08 bq4kno hairy .rar.exe
- C:\users\default\appdata\local\temp\horse yzw1afy [free] nrb42wq (karin).rar.exe
- C:\users\default\appdata\local\<INETFILES>\horse horse 7vepaqjm feet .mpeg.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\beast ddqayq bq4kno .avi.exe
- C:\users\default\templates\z1qxwcd mnho9y54 bq4kno .zip.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\8r3baiec 7nd83wovj 7nd83wovj vjq39c1gwy ae2sd7u4xh (cy4xpd,cy4xpd).zip.exe
- %TEMP%\porn mnho9y54 ihthd33 (hyo87il).zip.exe
- %LOCALAPPDATA%\<INETFILES>\f07qtt cum xakmpl l9hwcs7vvnphd9 (c4w8hqa,dxocjwba).zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\h93bklf horse bq4kno lady .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\0287zh porn yzw1afy [free] 40+ (36mho73).mpeg.exe
- %APPDATA%\microsoft\windows\templates\xakmpl hot (!) legs hairy .rar.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\sperm hot (!) legs ae2sd7u4xh .avi.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\f07qtt bd1l5ir lpcu5ai3 apv53deiq9fw qx2j1b5 (rdl1tfkz,hyo87il).mpg.exe
- %HOMEPATH%\templates\horse girls shoes .mpeg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\8ok6yf uncut cock mg9fvb2xk9 .zip.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\gzn4ud7e yzw1afy nude vjq39c1gwy fishy .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\beast wep6b08 l9hwcs7vvnphd9 hole eigt45 .rar.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\asian epyxwn .mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\mnho9y54 yzw1afy nom72kl (y8oxsqa,2hbt8wr).avi.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\f07qtt xxx apv53deiq9fw glans js80j73 .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\fac71w2 w6csjja14n1 [bangbus] nrb42wq (hyo87il).mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\ uncut boobs .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\eq7k2xcxt mzwpstr8n tsomq34 big .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\xxx ihthd33 titts fishy .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\xxx tsomq34 ihthd33 glans sgoibhh (karin).zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\black wep6b08 nude apv53deiq9fw (sandy,2hbt8wr).mpg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\mnho9y54 gay 7vepaqjm glans latex .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\asian horse vjq39c1gwy kfp2yqq .mpeg.exe
- %WINDIR%\assembly\temp\zc8giv9 beast sgu4m7oc (karin).mpg.exe
- %WINDIR%\assembly\tmp\zc8giv9 mnho9y54 8ok6yf big .zip.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\ ddqayq bq4kno .mpg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\sperm nom72kl sm .mpg.exe
- %WINDIR%\pla\templates\horse wep6b08 big sm .rar.exe
- %WINDIR%\security\templates\eq7k2xcxt beast lpcu5ai3 epyxwn .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\z1qxwcd lpcu5ai3 w6csjja14n1 uncut jxqgtp .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\porn vjq39c1gwy ash (hyo87il).rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\eq7k2xcxt horse horse ihthd33 (g6u8n4r).zip.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\lpcu5ai3 hot (!) .zip.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\jxaglwti horse [bangbus] gh5b6gd7wrv .mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\nom72kl h93bklf uncut gh5b6gd7wrv .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\gzn4ud7e beast epyxwn .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\beast nom72kl apv53deiq9fw rv0y8n .mpg.exe
- %WINDIR%\syswow64\fxstmp\gzn4ud7e bd1l5ir uncut .mpg.exe
- %WINDIR%\syswow64\ime\shared\zc8giv9 sperm h93bklf [free] cock .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\8r3baiec xakmpl sgu4m7oc .avi.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\s2fkave porn mnho9y54 uncut shoes .rar.exe
- %WINDIR%\syswow64\fxstmp\wpjwijv horse [bangbus] feet 50+ (gina,hyo87il).zip.exe
- %WINDIR%\syswow64\ime\shared\7b6fhxi h93bklf [bangbus] .zip.exe
- %WINDIR%\temp\xakmpl uncut 8pfmdyy .mpeg.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
