Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\tsomq34 [milf] 40+ .mpg.exe
- %ProgramFiles%\dvd maker\shared\black nude lpcu5ai3 l9hwcs7vvnphd9 6tl9zg0uqa .mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\horse nom72kl glans rv0y8n .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\fac71w2 porn mzwpstr8n [free] titts (sandy,2hbt8wr).zip.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\upfgetx ddqayq [free] .avi.exe
- %ProgramFiles%\microsoft office\templates\gzn4ud7e ddqayq xxx big nrb42wq (hyo87il,liz).zip.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\s2fkave nude beast nom72kl .mpeg.exe
- %ProgramFiles%\windows sidebar\shared gadgets\8r3baiec h93bklf lpcu5ai3 7vepaqjm .zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\fac71w2 8ok6yf sperm [bangbus] .avi.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\8r3baiec wep6b08 sgu4m7oc cock fw58kpr41ob1w (jade).mpeg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\fac71w2 bd1l5ir yzw1afy nom72kl 8bgkvshe1 .zip.exe
- %CommonProgramFiles(x86)%\microsoft shared\s2fkave h93bklf 7vepaqjm ejn547rbxhd1 .mpeg.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\sperm bq4kno hole eigt45 (g6u8n4r).zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\mnho9y54 girls (c4w8hqa).zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\yzw1afy big .zip.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\upfgetx 7nd83wovj tsomq34 [free] b37oavmx289 .zip.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\f1i7cm bd1l5ir gay [bangbus] (y8oxsqa).rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\eq7k2xcxt 7nd83wovj mzwpstr8n vjq39c1gwy young .rar.exe
- %ALLUSERSPROFILE%\templates\8r3baiec cum vjq39c1gwy 8bgkvshe1 .rar.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\beast sgu4m7oc 40+ .avi.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\z9z7rwe bd1l5ir lpcu5ai3 nom72kl .zip.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\mnho9y54 vjq39c1gwy .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\z9z7rwe h93bklf lpcu5ai3 hot (!) hole nmibe2 .zip.exe
- %ALLUSERSPROFILE%\templates\8r3baiec nude sperm hot (!) sgoibhh .avi.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\f07qtt 7nd83wovj gay girls ae2sd7u4xh (haj1oyikd,dxocjwba).rar.exe
- C:\users\default\appdata\local\temp\z9z7rwe 8ok6yf xxx ihthd33 js80j73 .mpg.exe
- C:\users\default\appdata\local\<INETFILES>\s2fkave h93bklf nom72kl 7vepaqjm glans .avi.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\upfgetx porn tsomq34 [milf] glans zn3tvn .mpg.exe
- C:\users\default\templates\z9z7rwe ddqayq beast ihthd33 feet .mpeg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\nom72kl 7vepaqjm titts .zip.exe
- %TEMP%\z9z7rwe nude yzw1afy hot (!) (sarah).zip.exe
- %LOCALAPPDATA%\<INETFILES>\nom72kl nom72kl cock js80j73 .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\ [bangbus] glans eigt45 .mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\black 7nd83wovj yzw1afy apv53deiq9fw cock zn3tvn (liz).rar.exe
- %LOCALAPPDATA%low\mozilla\temp-{3571406e-c08c-4c74-b145-8857b365f6e7}\z9z7rwe 7nd83wovj nom72kl sgu4m7oc titts boots .rar.exe
- %APPDATA%\microsoft\templates\mzwpstr8n uncut (liz).mpeg.exe
- %APPDATA%\microsoft\windows\templates\black bd1l5ir xxx uncut glans young .mpg.exe
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\f07qtt 8ok6yf sperm bq4kno .mpg.exe
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\black 8ok6yf nom72kl epyxwn cock sweet .avi.exe
- %HOMEPATH%\templates\fac71w2 bd1l5ir xxx uncut feet mg9fvb2xk9 .avi.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\z9z7rwe w6csjja14n1 yzw1afy l9hwcs7vvnphd9 779mipj .zip.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\xxx uncut (cy4xpd).rar.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\black ddqayq nom72kl l9hwcs7vvnphd9 .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\black bd1l5ir beast big (2hbt8wr).mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\gzn4ud7e bd1l5ir horse sgu4m7oc ae2sd7u4xh .mpg.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\8r3baiec h93bklf [milf] ol6p1tua .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\fac71w2 bd1l5ir gay hot (!) glans hairy (2hbt8wr).mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\black bd1l5ir sperm 7vepaqjm (liz).mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\black cum mzwpstr8n nom72kl b37oavmx289 .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\eq7k2xcxt w6csjja14n1 big .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\gzn4ud7e cum sperm big titts .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\horse vjq39c1gwy ae2sd7u4xh .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\black porn tsomq34 sgu4m7oc ejn547rbxhd1 .zip.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\lpcu5ai3 nom72kl zmc8ujp .mpeg.exe
- %WINDIR%\assembly\temp\lpcu5ai3 bq4kno titts .rar.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\wpjwijv yzw1afy big (dxocjwba).avi.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\gzn4ud7e porn sperm girls .mpg.exe
- %WINDIR%\pla\templates\mnho9y54 bq4kno (sarah).mpg.exe
- %WINDIR%\security\templates\nom72kl uncut cock 8bgkvshe1 .rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\xxx 7vepaqjm cock lady .rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\f07qtt horse tsomq34 [milf] ol6p1tua .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\z9z7rwe porn mzwpstr8n ihthd33 (karin).rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\tsomq34 nom72kl glans 8bgkvshe1 (karin).rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\mzwpstr8n uncut (jade).avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\f1i7cm wep6b08 sperm big feet sm .zip.exe
- %WINDIR%\syswow64\config\systemprofile\eq7k2xcxt 8ok6yf nom72kl [bangbus] hole .rar.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\black h93bklf horse l9hwcs7vvnphd9 (karin).avi.exe
- %WINDIR%\syswow64\fxstmp\beast l9hwcs7vvnphd9 40+ (haj1oyikd,y8oxsqa).avi.exe
- %WINDIR%\syswow64\ime\shared\mzwpstr8n [milf] nmibe2 .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\black ddqayq [free] hole .mpeg.exe
- %WINDIR%\syswow64\fxstmp\z9z7rwe nude beast sgu4m7oc lady .mpg.exe
- %WINDIR%\syswow64\ime\shared\f07qtt xakmpl uncut (c4w8hqa).mpeg.exe
- %WINDIR%\temp\nom72kl girls glans fishy .mpeg.exe
- %WINDIR%\winsxs\installtemp\8ok6yf mnho9y54 vjq39c1gwy .zip.exe
- <Current directory>\sqjaed7r1vnw
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
