Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\wpjwijv cum beast hot (!) qx2j1b5 (cy4xpd,jade).mpeg.exe
- %ProgramFiles%\dvd maker\shared\tsomq34 w6csjja14n1 epyxwn .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\z9z7rwe 8ok6yf xxx apv53deiq9fw .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\8r3baiec horse nude sgu4m7oc wifey .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\zc8giv9 mnho9y54 sgu4m7oc .rar.exe
- %ProgramFiles%\microsoft office\templates\ikdyfwhy horse 7nd83wovj sgu4m7oc balls .mpeg.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\mzwpstr8n tsomq34 nom72kl nrb42wq .mpeg.exe
- %ProgramFiles%\windows journal\templates\xakmpl beast apv53deiq9fw .avi.exe
- %ProgramFiles%\windows sidebar\shared gadgets\eq7k2xcxt porn l9hwcs7vvnphd9 .rar.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\z9z7rwe 7nd83wovj [milf] (sonja,liz).zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\lpcu5ai3 l9hwcs7vvnphd9 gsva2xn (c4w8hqa,sonja).zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\h93bklf tsomq34 bq4kno lzxyhb7k .avi.exe
- %CommonProgramFiles(x86)%\microsoft shared\wpjwijv tsomq34 [bangbus] (sonja).avi.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\black w6csjja14n1 uncut .rar.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\gzn4ud7e cum bq4kno 40+ .rar.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\ddqayq gay epyxwn sgoibhh .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\z1qxwcd cum h93bklf bq4kno boobs sm .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\f07qtt xxx sgu4m7oc ae2sd7u4xh .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\f1i7cm cum vjq39c1gwy jxqgtp ash .mpeg.exe
- %ALLUSERSPROFILE%\templates\black gay [milf] feet young .avi.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\f1i7cm horse nude hot (!) .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\8ok6yf porn bq4kno hairy .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\wpjwijv xakmpl nom72kl uncut .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\black 8ok6yf big ejn547rbxhd1 .zip.exe
- %ALLUSERSPROFILE%\templates\sperm wep6b08 [free] lzxyhb7k .zip.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\beast sperm vjq39c1gwy (2hbt8wr,hyo87il).mpg.exe
- C:\users\default\appdata\local\temp\zc8giv9 sperm uncut gsva2xn .mpg.exe
- C:\users\default\appdata\local\<INETFILES>\8r3baiec gay sgu4m7oc glans nmibe2 .mpg.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\7nd83wovj [bangbus] b37oavmx289 .rar.exe
- C:\users\default\templates\yzw1afy xxx [free] ash wifey (dxocjwba).mpeg.exe
- %TEMP%\f1i7cm w6csjja14n1 epyxwn young (rdl1tfkz,jade).avi.exe
- %LOCALAPPDATA%\<INETFILES>\7b6fhxi porn horse girls .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\7b6fhxi lpcu5ai3 [milf] hairy .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\lpcu5ai3 sgu4m7oc girly .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\gzn4ud7e wep6b08 uncut latex (karin).rar.exe
- %APPDATA%\microsoft\templates\0287zh sperm w6csjja14n1 girls cock 779mipj .rar.exe
- %APPDATA%\microsoft\windows\templates\zc8giv9 ddqayq nude l9hwcs7vvnphd9 (dehod0,cy4xpd).mpg.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\black mnho9y54 cum l9hwcs7vvnphd9 8pfmdyy .mpeg.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\upfgetx nom72kl sgu4m7oc mg9fvb2xk9 .rar.exe
- %HOMEPATH%\templates\upfgetx 8ok6yf [free] ash .mpeg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\0287zh w6csjja14n1 nom72kl nrb42wq .avi.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\upfgetx yzw1afy 8ok6yf [bangbus] zn3tvn (dxocjwba).rar.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\black mzwpstr8n big legs zmc8ujp .mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\7b6fhxi nude bq4kno sweet (36mho73,gina).avi.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\f1i7cm nom72kl nom72kl gh5b6gd7wrv .rar.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\ikdyfwhy mzwpstr8n l9hwcs7vvnphd9 .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\8r3baiec mzwpstr8n [bangbus] (dxocjwba,sandy).zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\beast h93bklf l9hwcs7vvnphd9 ol6p1tua (hyo87il).avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\mzwpstr8n [bangbus] boobs zn3tvn (36mho73).mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\gzn4ud7e beast l9hwcs7vvnphd9 .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\f07qtt mzwpstr8n sperm uncut sweet .mpeg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\gzn4ud7e gay wep6b08 bq4kno young .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\asian h93bklf 7vepaqjm feet wifey .mpg.exe
- %WINDIR%\assembly\temp\s2fkave mnho9y54 l9hwcs7vvnphd9 779mipj .zip.exe
- %WINDIR%\assembly\tmp\z1qxwcd gay hot (!) qq6w54yfhtqrbwcslg .rar.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\s2fkave tsomq34 ddqayq bq4kno legs zmc8ujp (g6u8n4r,sonja).zip.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\ikdyfwhy yzw1afy yzw1afy [free] eigt45 .avi.exe
- %WINDIR%\pla\templates\xakmpl nom72kl apv53deiq9fw 50+ .mpg.exe
- %WINDIR%\security\templates\asian tsomq34 epyxwn .rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\lpcu5ai3 yzw1afy bq4kno titts .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\gzn4ud7e uncut gsva2xn .rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\bd1l5ir xxx hot (!) (sandy,g6u8n4r).mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\cum epyxwn (jade,sandy).zip.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\wpjwijv xakmpl porn uncut boots (dehod0,liz).mpg.exe
- %WINDIR%\syswow64\config\systemprofile\4h1e2a346 7nd83wovj h93bklf 7vepaqjm .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\nude horse [milf] .zip.exe
- %WINDIR%\syswow64\fxstmp\f1i7cm mnho9y54 w6csjja14n1 [milf] boobs .rar.exe
- %WINDIR%\syswow64\ime\shared\jxaglwti xxx sgu4m7oc (jenna).zip.exe
- %WINDIR%\syswow64\config\systemprofile\eq7k2xcxt 7nd83wovj 7nd83wovj 7vepaqjm .avi.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\asian yzw1afy uncut hole rv0y8n .mpeg.exe
- %WINDIR%\syswow64\fxstmp\4h1e2a346 bd1l5ir 8ok6yf [milf] .zip.exe
- %WINDIR%\syswow64\ime\shared\eq7k2xcxt tsomq34 tsomq34 uncut wifey .avi.exe
- %WINDIR%\temp\f1i7cm mnho9y54 bq4kno qq6w54yfhtqrbwcslg .avi.exe
- %WINDIR%\winsxs\installtemp\s2fkave w6csjja14n1 8ok6yf 7vepaqjm glans (jade).avi.exe
- <Current directory>\sqjaed7r1vnw
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
