Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\sperm vjq39c1gwy qq6w54yfhtqrbwcslg .mpeg.exe
- %ProgramFiles%\dvd maker\shared\8r3baiec h93bklf horse [bangbus] titts .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\black h93bklf yzw1afy epyxwn titts eigt45 .mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\f1i7cm ddqayq horse epyxwn cock rv0y8n (jade).mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\eq7k2xcxt 8ok6yf mzwpstr8n vjq39c1gwy latex .rar.exe
- %ProgramFiles%\microsoft office\templates\gzn4ud7e 8ok6yf xxx nom72kl titts .avi.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\fac71w2 porn tsomq34 big lady .rar.exe
- %ProgramFiles%\windows journal\templates\s2fkave 7nd83wovj yzw1afy [free] glans ol6p1tua .rar.exe
- %ProgramFiles%\windows sidebar\shared gadgets\lpcu5ai3 big young .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\fac71w2 7nd83wovj horse [free] hotel (sandy,c4w8hqa).avi.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\eq7k2xcxt xakmpl lpcu5ai3 bq4kno sgoibhh .zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\eq7k2xcxt ddqayq mzwpstr8n 7vepaqjm titts sm .mpeg.exe
- %CommonProgramFiles(x86)%\microsoft shared\mzwpstr8n nom72kl (2hbt8wr).rar.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\gay l9hwcs7vvnphd9 hole .mpeg.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\s2fkave porn lpcu5ai3 ihthd33 mg9fvb2xk9 (sonja,sarah).zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\xxx epyxwn (y8oxsqa).mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\gay girls glans hotel .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\horse apv53deiq9fw feet ejn547rbxhd1 .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\s2fkave nude yzw1afy vjq39c1gwy (liz).mpg.exe
- %ALLUSERSPROFILE%\templates\black wep6b08 yzw1afy sgu4m7oc feet zmc8ujp (liz).mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\eq7k2xcxt h93bklf nom72kl girls glans .zip.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\upfgetx 7nd83wovj beast apv53deiq9fw .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\sperm 7vepaqjm 779mipj .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\f1i7cm 7nd83wovj mzwpstr8n uncut cock .mpeg.exe
- %ALLUSERSPROFILE%\templates\nom72kl uncut qq6w54yfhtqrbwcslg .mpg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\8r3baiec w6csjja14n1 tsomq34 [free] titts rv0y8n .mpeg.exe
- C:\users\default\appdata\local\temp\f07qtt wep6b08 gay ihthd33 cock (gina,2hbt8wr).avi.exe
- C:\users\default\appdata\local\<INETFILES>\f07qtt h93bklf sperm nom72kl 40+ (sonja,2hbt8wr).rar.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\f07qtt porn [free] .rar.exe
- C:\users\default\templates\8r3baiec horse epyxwn feet 40+ .mpg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\z9z7rwe h93bklf tsomq34 l9hwcs7vvnphd9 wifey (haj1oyikd,2hbt8wr).zip.exe
- %TEMP%\upfgetx bd1l5ir horse apv53deiq9fw feet (gina,g6u8n4r).avi.exe
- %LOCALAPPDATA%\<INETFILES>\horse big titts nmibe2 .rar.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\f1i7cm 7nd83wovj lpcu5ai3 7vepaqjm js80j73 .avi.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\fac71w2 w6csjja14n1 nom72kl apv53deiq9fw zn3tvn .rar.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\horse l9hwcs7vvnphd9 50+ .mpeg.exe
- %APPDATA%\microsoft\templates\s2fkave horse yzw1afy vjq39c1gwy feet gh5b6gd7wrv .mpeg.exe
- %APPDATA%\microsoft\windows\templates\eq7k2xcxt bd1l5ir girls 8bgkvshe1 .rar.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\horse vjq39c1gwy ol6p1tua .zip.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\f1i7cm wep6b08 mzwpstr8n vjq39c1gwy zn3tvn .rar.exe
- %HOMEPATH%\templates\z9z7rwe cum [free] .mpg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\s2fkave h93bklf yzw1afy uncut (c4w8hqa).rar.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\lpcu5ai3 [bangbus] zmc8ujp .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\z9z7rwe h93bklf xxx epyxwn titts 779mipj .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\z9z7rwe horse nom72kl ihthd33 40+ .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\gzn4ud7e 8ok6yf sperm bq4kno (jade).mpg.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\f07qtt nude horse apv53deiq9fw .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\8r3baiec nude xxx ihthd33 hole nmibe2 .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\mzwpstr8n [free] glans (gina,g6u8n4r).mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\eq7k2xcxt w6csjja14n1 lpcu5ai3 vjq39c1gwy .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\beast vjq39c1gwy feet .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\f1i7cm horse xxx nom72kl feet js80j73 .avi.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\jxaglwti mnho9y54 apv53deiq9fw nrb42wq .zip.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\nom72kl [bangbus] boots .zip.exe
- %WINDIR%\assembly\temp\black cum xxx vjq39c1gwy .rar.exe
- %WINDIR%\assembly\tmp\lpcu5ai3 vjq39c1gwy (jade).zip.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\lpcu5ai3 epyxwn ol6p1tua .mpeg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\horse ihthd33 boots (dehod0,y8oxsqa).avi.exe
- %WINDIR%\pla\templates\eq7k2xcxt 7nd83wovj beast vjq39c1gwy feet .rar.exe
- %WINDIR%\security\templates\sperm epyxwn ash (haj1oyikd,2hbt8wr).mpg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\yzw1afy bq4kno js80j73 .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\f1i7cm nude tsomq34 bq4kno feet nrb42wq .rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\fac71w2 8ok6yf gay uncut hairy .mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\mnho9y54 nom72kl .zip.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\sperm hot (!) 6tl9zg0uqa .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\mnho9y54 epyxwn glans shoes (liz).mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\eq7k2xcxt cum big .zip.exe
- %WINDIR%\syswow64\fxstmp\4h1e2a346 lpcu5ai3 vjq39c1gwy glans .zip.exe
- %WINDIR%\syswow64\ime\shared\eq7k2xcxt w6csjja14n1 yzw1afy [milf] hole .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\black cum sperm girls feet nrb42wq (g6u8n4r).avi.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\fac71w2 cum mnho9y54 l9hwcs7vvnphd9 glans 8bgkvshe1 .avi.exe
- %WINDIR%\syswow64\fxstmp\xxx [free] titts girly .mpeg.exe
- %WINDIR%\syswow64\ime\shared\mnho9y54 big young .mpg.exe
- %WINDIR%\temp\z9z7rwe h93bklf tsomq34 hot (!) cock .mpeg.exe
- %WINDIR%\winsxs\installtemp\zc8giv9 yzw1afy 7vepaqjm (jade).avi.exe
- <Current directory>\sqjaed7r1vnw
- %CommonProgramFiles%\microsoft shared\tsomq34 nom72kl sgu4m7oc ash (jade,sarah).rar.exe
- %CommonProgramFiles%\microsoft shared\gzn4ud7e girls (gina).rar.exe
- %ProgramFiles%\dvd maker\shared\ikdyfwhy tsomq34 [free] ash .avi.exe
- %ProgramFiles%\dvd maker\shared\0287zh xakmpl horse ihthd33 qq6w54yfhtqrbwcslg .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\wpjwijv 8ok6yf tsomq34 epyxwn kfp2yqq nrb42wq .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\0287zh l9hwcs7vvnphd9 rv0y8n .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\porn porn 7vepaqjm balls .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\eq7k2xcxt bd1l5ir vjq39c1gwy fw58kpr41ob1w .zip.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\f07qtt wep6b08 nom72kl ihthd33 .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\zc8giv9 xakmpl lpcu5ai3 l9hwcs7vvnphd9 legs .mpeg.exe
- %ProgramFiles%\microsoft office\templates\bd1l5ir epyxwn jxqgtp hairy .mpeg.exe
- %ProgramFiles%\microsoft office\templates\w6csjja14n1 8ok6yf [milf] kfp2yqq gsva2xn (36mho73,c4w8hqa).mpg.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\xakmpl yzw1afy hot (!) 40+ .avi.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\mnho9y54 lpcu5ai3 [free] .mpg.exe
- %ProgramFiles%\windows journal\templates\black nude [milf] boobs zn3tvn .mpeg.exe
- %ProgramFiles%\windows sidebar\shared gadgets\zc8giv9 yzw1afy xxx apv53deiq9fw young .avi.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\black mzwpstr8n nom72kl gsva2xn (rdl1tfkz,dxocjwba).mpeg.exe
- %ProgramFiles%\windows sidebar\shared gadgets\ikdyfwhy beast horse big titts hairy (sandy).avi.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\ikdyfwhy xxx 7vepaqjm nmibe2 .rar.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\black ddqayq uncut sweet .zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\ bd1l5ir uncut .rar.exe
- %CommonProgramFiles(x86)%\microsoft shared\f1i7cm 7nd83wovj apv53deiq9fw young .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\ddqayq apv53deiq9fw hole .mpeg.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\eq7k2xcxt h93bklf l9hwcs7vvnphd9 (jenna).mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\8r3baiec xakmpl h93bklf sgu4m7oc .avi.exe
- %CommonProgramFiles(x86)%\microsoft shared\horse [milf] girly .mpg.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\eq7k2xcxt 8ok6yf bq4kno jxqgtp (liz,hyo87il).zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\4h1e2a346 porn epyxwn ae2sd7u4xh .mpeg.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\z1qxwcd nude sperm sgu4m7oc (jade,2hbt8wr).avi.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\black xxx porn bq4kno (gina).mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\horse l9hwcs7vvnphd9 mg9fvb2xk9 .rar.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\f1i7cm lpcu5ai3 uncut .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\viaz50 xxx mnho9y54 vjq39c1gwy 8bgkvshe1 .rar.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\fac71w2 mzwpstr8n lpcu5ai3 big glans eigt45 (dxocjwba).avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\ikdyfwhy nom72kl nom72kl 7vepaqjm b37oavmx289 (g6u8n4r).rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\0287zh xakmpl vjq39c1gwy .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\f1i7cm porn mnho9y54 nom72kl nrb42wq .avi.exe
- %ALLUSERSPROFILE%\templates\z9z7rwe mnho9y54 7nd83wovj uncut kfp2yqq .rar.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\fac71w2 bd1l5ir horse 7vepaqjm lzxyhb7k (cy4xpd,c4w8hqa).mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\jxaglwti nude bd1l5ir uncut ejn547rbxhd1 .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\7b6fhxi nude nom72kl uncut .mpeg.exe
- %ALLUSERSPROFILE%\templates\bd1l5ir nude epyxwn cock qq6w54yfhtqrbwcslg (sonja).zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\8r3baiec w6csjja14n1 apv53deiq9fw .zip.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\f07qtt nom72kl mnho9y54 l9hwcs7vvnphd9 cock .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\viaz50 nude w6csjja14n1 [free] jxqgtp .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\wep6b08 nom72kl uncut .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\nom72kl porn epyxwn nrb42wq (sarah).avi.exe
- %ALLUSERSPROFILE%\templates\mnho9y54 [bangbus] nrb42wq .mpg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\viaz50 gay girls .zip.exe
- %ALLUSERSPROFILE%\templates\z1qxwcd h93bklf [free] (sonja,sarah).avi.exe
- C:\users\default\appdata\local\temp\gzn4ud7e xxx mnho9y54 apv53deiq9fw .rar.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\s2fkave sperm beast big qq6w54yfhtqrbwcslg (jenna).mpg.exe
- C:\users\default\appdata\local\temp\z1qxwcd 8ok6yf uncut .zip.exe
- C:\users\default\appdata\local\<INETFILES>\s2fkave xakmpl 8ok6yf nom72kl qq6w54yfhtqrbwcslg .zip.exe
- C:\users\default\appdata\local\<INETFILES>\z9z7rwe gay bd1l5ir uncut feet js80j73 (y8oxsqa,hyo87il).mpeg.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\horse girls rv0y8n .zip.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\0287zh 7nd83wovj mnho9y54 [milf] hole .zip.exe
- C:\users\default\templates\cum sgu4m7oc kfp2yqq .zip.exe
- C:\users\default\templates\gay [milf] gsva2xn .mpg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\z1qxwcd lpcu5ai3 mzwpstr8n uncut .mpg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\s2fkave 7nd83wovj mnho9y54 uncut sweet .zip.exe
- %TEMP%\f07qtt horse w6csjja14n1 bq4kno 8bgkvshe1 (liz,sarah).mpg.exe
- %TEMP%\0287zh 7nd83wovj nom72kl uncut legs .zip.exe
- %LOCALAPPDATA%\<INETFILES>\jxaglwti xxx epyxwn .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\8r3baiec tsomq34 uncut .mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\black porn [free] 6tl9zg0uqa .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\black 8ok6yf ihthd33 mg9fvb2xk9 .avi.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\xakmpl ihthd33 .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\ikdyfwhy w6csjja14n1 horse l9hwcs7vvnphd9 8pfmdyy (g6u8n4r,rdl1tfkz).mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\xxx sperm [milf] lzxyhb7k .zip.exe
- %APPDATA%\microsoft\templates\black beast l9hwcs7vvnphd9 sweet (liz,cy4xpd).avi.exe
- %APPDATA%\microsoft\templates\f07qtt [milf] titts hairy .rar.exe
- %APPDATA%\microsoft\windows\templates\8ok6yf bq4kno 8bgkvshe1 (jenna,sonja).rar.exe
- %APPDATA%\microsoft\windows\templates\mzwpstr8n apv53deiq9fw hairy .mpg.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\cum girls zn3tvn .mpeg.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\ xakmpl nom72kl mg9fvb2xk9 (sandy,sonja).rar.exe
- %HOMEPATH%\templates\z9z7rwe cum nom72kl epyxwn js80j73 (jade).mpeg.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\8r3baiec ddqayq bq4kno sweet .avi.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\f07qtt porn sperm bq4kno kfp2yqq shoes .mpg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\gay [bangbus] 40+ .avi.exe
- %HOMEPATH%\templates\7b6fhxi horse bq4kno boots .rar.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\tsomq34 nom72kl zmc8ujp .mpg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\f1i7cm porn uncut .rar.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\xakmpl [milf] titts shoes .rar.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\4h1e2a346 8ok6yf girls (liz,gina).mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\cum 7vepaqjm (dehod0,rdl1tfkz).mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\gzn4ud7e horse apv53deiq9fw feet .mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\wpjwijv horse bq4kno (sandy).mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\nom72kl beast vjq39c1gwy ol6p1tua (jenna).zip.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\ vjq39c1gwy (cy4xpd).avi.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\wpjwijv beast girls zn3tvn .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\fac71w2 cum girls hole .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\upfgetx horse xxx uncut boobs (sonja,sonja).zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\z9z7rwe horse [free] legs .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\zc8giv9 8ok6yf girls .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\asian wep6b08 apv53deiq9fw legs .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\porn big ejn547rbxhd1 .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\gzn4ud7e bd1l5ir cum hot (!) (sarah).mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\horse tsomq34 [free] 40+ .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\w6csjja14n1 yzw1afy hot (!) feet wifey (36mho73).rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\black horse vjq39c1gwy 8pfmdyy .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\7b6fhxi w6csjja14n1 cum bq4kno jxqgtp .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\tsomq34 beast girls .avi.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\nom72kl bq4kno ae2sd7u4xh (rdl1tfkz,gina).zip.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\4h1e2a346 bd1l5ir [milf] eigt45 .avi.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\7b6fhxi bd1l5ir h93bklf vjq39c1gwy hole girly (cy4xpd,dxocjwba).mpg.exe
- %WINDIR%\assembly\temp\porn mnho9y54 l9hwcs7vvnphd9 glans (jade).mpeg.exe
- %WINDIR%\assembly\tmp\h93bklf l9hwcs7vvnphd9 779mipj (gina,c4w8hqa).rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\f07qtt yzw1afy 7vepaqjm (sarah,y8oxsqa).mpeg.exe
- %WINDIR%\assembly\temp\f07qtt nude lpcu5ai3 big kfp2yqq .mpeg.exe
- %WINDIR%\assembly\tmp\ddqayq xxx uncut .mpg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\asian mnho9y54 nom72kl ol6p1tua .mpeg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\xxx beast epyxwn glans young (sarah).zip.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\fac71w2 porn 8ok6yf l9hwcs7vvnphd9 boots (jade,jade).mpg.exe
- %WINDIR%\pla\templates\fac71w2 cum porn 7vepaqjm .avi.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\wpjwijv porn wep6b08 l9hwcs7vvnphd9 girly (sarah,jade).zip.exe
- %WINDIR%\pla\templates\wep6b08 ddqayq vjq39c1gwy legs (liz).rar.exe
- %WINDIR%\security\templates\viaz50 horse [bangbus] wifey .mpeg.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
