Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\8r3baiec xakmpl wep6b08 epyxwn .zip.exe
- %ProgramFiles%\dvd maker\shared\w6csjja14n1 hot (!) .zip.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\z9z7rwe w6csjja14n1 [milf] boobs rv0y8n .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\bd1l5ir ihthd33 (liz,liz).mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\porn nude bq4kno boobs nmibe2 .avi.exe
- %ProgramFiles%\microsoft office\templates\7b6fhxi h93bklf mnho9y54 [milf] jxqgtp boots .mpg.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\black sperm epyxwn (sarah,sarah).mpeg.exe
- %ProgramFiles%\windows journal\templates\s2fkave cum tsomq34 ihthd33 (rdl1tfkz,g6u8n4r).avi.exe
- %ProgramFiles%\windows sidebar\shared gadgets\upfgetx cum nom72kl bq4kno .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\z9z7rwe yzw1afy 8ok6yf l9hwcs7vvnphd9 (g6u8n4r,dxocjwba).zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\7b6fhxi nude nom72kl [milf] titts .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\tsomq34 uncut gh5b6gd7wrv .rar.exe
- %CommonProgramFiles(x86)%\microsoft shared\gay 7vepaqjm legs .mpeg.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\fac71w2 cum 7vepaqjm .zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\wpjwijv ddqayq wep6b08 bq4kno .rar.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\viaz50 tsomq34 nom72kl .avi.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\8r3baiec porn bq4kno lady .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\black xakmpl uncut titts .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\ikdyfwhy mnho9y54 w6csjja14n1 nom72kl (dehod0,sarah).mpg.exe
- %ALLUSERSPROFILE%\templates\ sgu4m7oc shoes .avi.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\7b6fhxi sperm horse sgu4m7oc hotel .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\z1qxwcd wep6b08 girls (2hbt8wr,jade).mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\ikdyfwhy sperm yzw1afy ihthd33 gsva2xn .mpeg.exe
- %ALLUSERSPROFILE%\templates\sperm vjq39c1gwy 40+ .zip.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\fac71w2 beast horse nom72kl glans qq6w54yfhtqrbwcslg (dxocjwba).avi.exe
- C:\users\default\appdata\local\temp\beast hot (!) .mpeg.exe
- C:\users\default\appdata\local\<INETFILES>\jxaglwti xakmpl sperm uncut ash .avi.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\viaz50 horse nom72kl hotel (jade,jenna).rar.exe
- C:\users\default\templates\eq7k2xcxt lpcu5ai3 sgu4m7oc 779mipj .zip.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\black xxx 7vepaqjm sweet .zip.exe
- %TEMP%\gay lpcu5ai3 girls .avi.exe
- %LOCALAPPDATA%\<INETFILES>\lpcu5ai3 uncut ol6p1tua .mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\4h1e2a346 cum sgu4m7oc zmc8ujp .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\lpcu5ai3 bq4kno .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{3571406e-c08c-4c74-b145-8857b365f6e7}\f07qtt tsomq34 ihthd33 .rar.exe
- %APPDATA%\microsoft\templates\jxaglwti porn 7nd83wovj l9hwcs7vvnphd9 fw58kpr41ob1w (dxocjwba,36mho73).mpg.exe
- %APPDATA%\microsoft\windows\templates\black mzwpstr8n 7vepaqjm lady .mpg.exe
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\asian nom72kl big lady .mpg.exe
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\4h1e2a346 lpcu5ai3 tsomq34 bq4kno fw58kpr41ob1w .mpg.exe
- %HOMEPATH%\templates\gzn4ud7e wep6b08 gay sgu4m7oc fw58kpr41ob1w (hyo87il).rar.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\8ok6yf ihthd33 .mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\eq7k2xcxt sperm bq4kno fishy .mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\lpcu5ai3 mzwpstr8n nom72kl zn3tvn (jade,dxocjwba).mpg.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\gzn4ud7e bd1l5ir ddqayq bq4kno .mpeg.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\f1i7cm xakmpl porn [bangbus] 6tl9zg0uqa .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\viaz50 mnho9y54 nom72kl l9hwcs7vvnphd9 6tl9zg0uqa .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\yzw1afy [milf] boobs ash .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\horse nom72kl nmibe2 (cy4xpd,jade).zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\lpcu5ai3 mnho9y54 ihthd33 .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\0287zh nom72kl mnho9y54 nom72kl 779mipj (rdl1tfkz).avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\horse vjq39c1gwy .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\mnho9y54 ihthd33 zn3tvn .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\nude epyxwn boobs .mpeg.exe
- %WINDIR%\assembly\temp\4h1e2a346 yzw1afy 7vepaqjm .zip.exe
- %WINDIR%\assembly\tmp\z9z7rwe xakmpl nom72kl [milf] girly (karin,36mho73).rar.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\zc8giv9 lpcu5ai3 mzwpstr8n [milf] hole .avi.exe
- %WINDIR%\pla\templates\wep6b08 uncut 40+ .avi.exe
- %WINDIR%\security\templates\gay l9hwcs7vvnphd9 fw58kpr41ob1w .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\ikdyfwhy 7nd83wovj w6csjja14n1 [milf] sweet .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\f1i7cm ddqayq l9hwcs7vvnphd9 .avi.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\8r3baiec tsomq34 h93bklf nom72kl .mpeg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\ddqayq hot (!) ae2sd7u4xh .rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\z1qxwcd horse sgu4m7oc ash .avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\s2fkave gay xxx vjq39c1gwy ol6p1tua .zip.exe
- %WINDIR%\syswow64\config\systemprofile\nom72kl bq4kno shoes .zip.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\beast big hairy .zip.exe
- %WINDIR%\syswow64\fxstmp\zc8giv9 yzw1afy nom72kl .avi.exe
- %WINDIR%\syswow64\ime\shared\black horse ddqayq [milf] titts (sandy,liz).mpg.exe
- %WINDIR%\syswow64\config\systemprofile\fac71w2 tsomq34 apv53deiq9fw ejn547rbxhd1 .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\nom72kl bq4kno (jenna,karin).mpeg.exe
- %WINDIR%\syswow64\fxstmp\8r3baiec 7nd83wovj bd1l5ir apv53deiq9fw qx2j1b5 .mpeg.exe
- %WINDIR%\syswow64\ime\shared\f07qtt cum uncut .mpeg.exe
- %WINDIR%\temp\tsomq34 porn l9hwcs7vvnphd9 boobs js80j73 .avi.exe
- %WINDIR%\winsxs\installtemp\tsomq34 mnho9y54 l9hwcs7vvnphd9 feet sm .mpeg.exe
- <Current directory>\sqjaed7r1vnw
- %CommonProgramFiles%\microsoft shared\fac71w2 wep6b08 gay epyxwn .zip.exe
- %CommonProgramFiles%\microsoft shared\z9z7rwe porn yzw1afy nom72kl 50+ .avi.exe
- %ProgramFiles%\dvd maker\shared\fac71w2 wep6b08 lpcu5ai3 bq4kno cock (dehod0,jade).mpg.exe
- %ProgramFiles%\dvd maker\shared\gzn4ud7e 8ok6yf mzwpstr8n ihthd33 glans ejn547rbxhd1 .mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\tsomq34 uncut hole .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\mzwpstr8n [bangbus] titts rv0y8n (c4w8hqa).rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\f1i7cm h93bklf lpcu5ai3 l9hwcs7vvnphd9 hole ae2sd7u4xh .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\4h1e2a346 tsomq34 big titts .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\f07qtt xakmpl xxx uncut titts wifey .avi.exe
- %ProgramFiles%\microsoft office\templates\eq7k2xcxt w6csjja14n1 horse [bangbus] glans .rar.exe
- %ProgramFiles%\microsoft office\templates\gzn4ud7e 7nd83wovj tsomq34 hot (!) (jade).mpeg.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\s2fkave xakmpl mzwpstr8n 7vepaqjm latex .zip.exe
- %ProgramFiles%\windows journal\templates\s2fkave w6csjja14n1 gay vjq39c1gwy wifey .avi.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\eq7k2xcxt bd1l5ir yzw1afy vjq39c1gwy cock 779mipj .zip.exe
- %ProgramFiles%\windows sidebar\shared gadgets\8r3baiec nude mzwpstr8n uncut (dxocjwba).rar.exe
- %ProgramFiles%\windows journal\templates\gzn4ud7e cum xxx vjq39c1gwy ejn547rbxhd1 .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\z9z7rwe ddqayq xxx hot (!) (c4w8hqa).zip.exe
- %ProgramFiles%\windows sidebar\shared gadgets\upfgetx nude xxx uncut b37oavmx289 (rdl1tfkz,2hbt8wr).zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\nom72kl [bangbus] hole 6tl9zg0uqa .mpeg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\sperm [milf] 40+ .mpeg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\beast apv53deiq9fw titts latex .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\f1i7cm nude mnho9y54 bq4kno (y8oxsqa).mpeg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\upfgetx ddqayq mnho9y54 ihthd33 .zip.exe
- %CommonProgramFiles(x86)%\microsoft shared\eq7k2xcxt cum horse hot (!) wifey .mpeg.exe
- %CommonProgramFiles(x86)%\microsoft shared\mnho9y54 uncut b37oavmx289 .avi.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\horse [free] hole .zip.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\beast nom72kl .rar.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\mzwpstr8n uncut sweet .rar.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\8r3baiec bd1l5ir nom72kl apv53deiq9fw feet hotel .zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\beast [free] ejn547rbxhd1 .zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\yzw1afy big fw58kpr41ob1w .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\ 7vepaqjm feet .mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\fac71w2 ddqayq yzw1afy [free] lady .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\xxx hot (!) feet hairy .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\fac71w2 cum sperm apv53deiq9fw (karin).rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\fac71w2 xakmpl horse hot (!) balls .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\lpcu5ai3 ihthd33 ejn547rbxhd1 .mpg.exe
- %ALLUSERSPROFILE%\templates\eq7k2xcxt bd1l5ir nom72kl uncut titts boots .rar.exe
- %ALLUSERSPROFILE%\templates\upfgetx nude nom72kl vjq39c1gwy titts (hyo87il,c4w8hqa).mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\lpcu5ai3 apv53deiq9fw (jade).mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\f1i7cm bd1l5ir yzw1afy sgu4m7oc titts b37oavmx289 .rar.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\eq7k2xcxt h93bklf yzw1afy 7vepaqjm glans nmibe2 .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\tsomq34 [milf] titts .zip.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\z9z7rwe bd1l5ir sgu4m7oc titts .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\nom72kl hot (!) feet ae2sd7u4xh (y8oxsqa).mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\upfgetx nude tsomq34 vjq39c1gwy feet ae2sd7u4xh .rar.exe
- %ALLUSERSPROFILE%\templates\gay apv53deiq9fw feet gh5b6gd7wrv .avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\fac71w2 bd1l5ir yzw1afy vjq39c1gwy cock lzxyhb7k (sarah).avi.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\upfgetx 8ok6yf yzw1afy nom72kl nmibe2 .avi.exe
- C:\users\default\appdata\local\temp\mnho9y54 7vepaqjm glans nmibe2 (jade).avi.exe
- C:\users\default\appdata\local\<INETFILES>\gzn4ud7e 7nd83wovj lpcu5ai3 girls .zip.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\gzn4ud7e bd1l5ir mnho9y54 uncut cock .rar.exe
- C:\users\default\templates\nom72kl nom72kl balls .rar.exe
- %ALLUSERSPROFILE%\templates\eq7k2xcxt porn nom72kl sgu4m7oc hole sweet .mpeg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\lpcu5ai3 [free] 8pfmdyy .avi.exe
- C:\users\default\appdata\local\temp\fac71w2 nude tsomq34 vjq39c1gwy feet gh5b6gd7wrv .mpeg.exe
- C:\users\default\appdata\local\<INETFILES>\gzn4ud7e w6csjja14n1 mnho9y54 apv53deiq9fw titts .mpeg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\gzn4ud7e nude lpcu5ai3 [free] qx2j1b5 .zip.exe
- %TEMP%\z9z7rwe xakmpl mnho9y54 [free] lady .zip.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\mnho9y54 [bangbus] titts .rar.exe
- %LOCALAPPDATA%\<INETFILES>\eq7k2xcxt porn horse l9hwcs7vvnphd9 .mpg.exe
- C:\users\default\templates\fac71w2 8ok6yf beast [free] hole (haj1oyikd,g6u8n4r).mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\upfgetx wep6b08 lpcu5ai3 epyxwn rv0y8n (gina,y8oxsqa).mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\nom72kl l9hwcs7vvnphd9 .avi.exe
- %APPDATA%\microsoft\templates\gay apv53deiq9fw feet .avi.exe
- %APPDATA%\microsoft\windows\templates\xxx [free] ol6p1tua .avi.exe
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\zc8giv9 xxx sgu4m7oc glans lady (y8oxsqa).mpeg.exe
- %HOMEPATH%\templates\sperm l9hwcs7vvnphd9 feet .rar.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\xxx girls glans ol6p1tua (cy4xpd).mpg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\yzw1afy nom72kl titts rv0y8n .avi.exe
- %LOCALAPPDATA%\<INETFILES>\h93bklf sperm [bangbus] .mpeg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\lpcu5ai3 [milf] glans .rar.exe
- %LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\z9z7rwe 8ok6yf [milf] hairy .mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\tsomq34 big glans .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\black wep6b08 nom72kl girls .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\8r3baiec nude lpcu5ai3 [bangbus] (karin).mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{3571406e-c08c-4c74-b145-8857b365f6e7}\eq7k2xcxt w6csjja14n1 tsomq34 big b37oavmx289 .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\xxx big gh5b6gd7wrv .zip.exe
- %APPDATA%\microsoft\templates\fac71w2 porn mzwpstr8n 7vepaqjm .mpg.exe
- %APPDATA%\microsoft\windows\templates\f1i7cm cum tsomq34 vjq39c1gwy feet 6tl9zg0uqa (cy4xpd).mpg.exe
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\s2fkave h93bklf lpcu5ai3 uncut glans .mpg.exe
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\gzn4ud7e nude mzwpstr8n [milf] titts mg9fvb2xk9 .mpg.exe
- %HOMEPATH%\templates\eq7k2xcxt 8ok6yf xxx nom72kl latex .mpg.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\yzw1afy l9hwcs7vvnphd9 titts .rar.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\mzwpstr8n [bangbus] .zip.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\nom72kl ihthd33 glans mg9fvb2xk9 .mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\s2fkave 8ok6yf nom72kl uncut titts gh5b6gd7wrv .mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\horse sgu4m7oc ae2sd7u4xh .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\nom72kl [free] latex .avi.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\8r3baiec porn horse sgu4m7oc .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\ nom72kl qx2j1b5 (sonja,jade).avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\f07qtt ddqayq yzw1afy uncut ae2sd7u4xh .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\z9z7rwe wep6b08 l9hwcs7vvnphd9 (y8oxsqa).mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\f1i7cm nude nom72kl [milf] ae2sd7u4xh (jenna,g6u8n4r).zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\upfgetx porn yzw1afy 7vepaqjm mg9fvb2xk9 .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\gay ihthd33 .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\s2fkave porn tsomq34 girls hotel .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\xxx big feet fw58kpr41ob1w .mpg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\black nude uncut .avi.exe
- %WINDIR%\assembly\temp\ikdyfwhy yzw1afy l9hwcs7vvnphd9 nmibe2 .mpeg.exe
- %WINDIR%\assembly\tmp\black horse sperm nom72kl lzxyhb7k .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\black xakmpl horse ihthd33 cock fishy .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\black horse sperm nom72kl hole rv0y8n .avi.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\nom72kl [free] hotel .rar.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\f07qtt xakmpl tsomq34 epyxwn hole (sandy,2hbt8wr).zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\eq7k2xcxt w6csjja14n1 mzwpstr8n nom72kl titts .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\ nom72kl boots .rar.exe
- %WINDIR%\security\templates\ ihthd33 hole latex (dxocjwba).zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\ [bangbus] (y8oxsqa).zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\8r3baiec w6csjja14n1 horse bq4kno (sarah).mpeg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\black 8ok6yf beast big titts (sandy,2hbt8wr).avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\8r3baiec cum tsomq34 vjq39c1gwy .zip.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\gzn4ud7e bd1l5ir beast hot (!) boots .mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\f1i7cm nude lpcu5ai3 hot (!) hole .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\eq7k2xcxt porn tsomq34 bq4kno 779mipj .zip.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\mnho9y54 girls (jade).avi.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\gzn4ud7e porn gay l9hwcs7vvnphd9 girly .mpg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\f07qtt porn lpcu5ai3 [free] (sarah).rar.exe
- %WINDIR%\assembly\temp\xxx bq4kno cock ol6p1tua .rar.exe
- %WINDIR%\assembly\tmp\sperm bq4kno .mpeg.exe
- %WINDIR%\syswow64\fxstmp\z1qxwcd beast big .rar.exe
- %WINDIR%\syswow64\ime\shared\gay [free] .avi.exe
- %WINDIR%\syswow64\config\systemprofile\upfgetx ddqayq sperm vjq39c1gwy ejn547rbxhd1 .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\gzn4ud7e cum uncut (y8oxsqa).mpg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\8r3baiec porn mnho9y54 nom72kl cock fishy .zip.exe
- %WINDIR%\syswow64\fxstmp\lpcu5ai3 sgu4m7oc .rar.exe
- %WINDIR%\syswow64\ime\shared\mzwpstr8n hot (!) sweet (gina,2hbt8wr).mpeg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\gzn4ud7e 8ok6yf nom72kl vjq39c1gwy .zip.exe
- %WINDIR%\pla\templates\z9z7rwe h93bklf mzwpstr8n apv53deiq9fw cock balls .rar.exe
- %WINDIR%\security\templates\gay sgu4m7oc sweet .mpeg.exe
- %WINDIR%\temp\gay hot (!) cock .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\f07qtt ddqayq gay l9hwcs7vvnphd9 (cy4xpd).rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\7b6fhxi beast big titts .mpeg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\sperm [free] .mpeg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\eq7k2xcxt 8ok6yf lpcu5ai3 ihthd33 ash .avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\s2fkave horse l9hwcs7vvnphd9 feet 50+ .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\gay bq4kno hole zmc8ujp (y8oxsqa).rar.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\f07qtt w6csjja14n1 nom72kl uncut titts .zip.exe
- %WINDIR%\syswow64\fxstmp\ddqayq beast nom72kl hole boots .rar.exe
- %WINDIR%\syswow64\ime\shared\s2fkave ddqayq gay apv53deiq9fw .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\beast 7vepaqjm js80j73 (haj1oyikd,liz).mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\f1i7cm horse sperm big lzxyhb7k .rar.exe
- %WINDIR%\syswow64\fxstmp\eq7k2xcxt bd1l5ir mzwpstr8n apv53deiq9fw titts lzxyhb7k .zip.exe
- %WINDIR%\syswow64\ime\shared\yzw1afy uncut .avi.exe
- %WINDIR%\temp\upfgetx porn mnho9y54 uncut hole lady .zip.exe
- %WINDIR%\winsxs\installtemp\0287zh mzwpstr8n big .mpeg.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
