Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\porn [bangbus] boobs .mpeg.exe
- %ProgramFiles%\dvd maker\shared\z9z7rwe gay mnho9y54 epyxwn boots .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\lpcu5ai3 bd1l5ir hot (!) .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\4h1e2a346 lpcu5ai3 porn hot (!) (sonja).zip.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\4h1e2a346 porn [free] (sonja,sandy).rar.exe
- %ProgramFiles%\microsoft office\templates\0287zh yzw1afy nom72kl ash .rar.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\cum vjq39c1gwy legs sweet .mpg.exe
- %ProgramFiles%\windows journal\templates\z9z7rwe h93bklf cum apv53deiq9fw kfp2yqq sm .mpeg.exe
- %ProgramFiles%\windows sidebar\shared gadgets\horse ddqayq [milf] .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\mnho9y54 8ok6yf bq4kno .mpeg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\xakmpl horse [free] 8bgkvshe1 (dehod0,jenna).mpeg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\ddqayq l9hwcs7vvnphd9 (sonja).rar.exe
- %CommonProgramFiles(x86)%\microsoft shared\asian yzw1afy sperm uncut ash (sarah,sonja).mpeg.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\z1qxwcd nude w6csjja14n1 hot (!) kfp2yqq ash .zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\f07qtt lpcu5ai3 nom72kl .zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\f1i7cm mnho9y54 7vepaqjm ol6p1tua .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\h93bklf bd1l5ir 7vepaqjm nrb42wq .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\0287zh wep6b08 bq4kno 779mipj (36mho73,g6u8n4r).rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\gay epyxwn b37oavmx289 .mpg.exe
- %ALLUSERSPROFILE%\templates\jxaglwti sperm girls sgoibhh .avi.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\f07qtt [free] titts .mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\jxaglwti cum big (haj1oyikd,rdl1tfkz).mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\lpcu5ai3 7nd83wovj 7vepaqjm (sarah,sonja).avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\asian horse xxx nom72kl gh5b6gd7wrv (karin,36mho73).avi.exe
- %ALLUSERSPROFILE%\templates\z1qxwcd ddqayq 8ok6yf [free] 8pfmdyy .zip.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\lpcu5ai3 uncut fw58kpr41ob1w .mpg.exe
- C:\users\default\appdata\local\temp\xxx bq4kno 40+ .avi.exe
- C:\users\default\appdata\local\<INETFILES>\4h1e2a346 8ok6yf sgu4m7oc hole .mpg.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\lpcu5ai3 wep6b08 apv53deiq9fw cock lady .mpg.exe
- C:\users\default\templates\zc8giv9 yzw1afy beast big hole (dxocjwba).mpeg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\w6csjja14n1 xakmpl girls sweet (hyo87il,jade).mpg.exe
- %TEMP%\black porn nom72kl vjq39c1gwy .mpg.exe
- %LOCALAPPDATA%\<INETFILES>\8r3baiec porn yzw1afy ihthd33 .avi.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\porn apv53deiq9fw 40+ .mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\xxx horse [bangbus] wifey .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\viaz50 xakmpl mzwpstr8n l9hwcs7vvnphd9 (c4w8hqa).mpeg.exe
- %APPDATA%\microsoft\templates\porn [free] shoes (cy4xpd).rar.exe
- %APPDATA%\microsoft\windows\templates\gzn4ud7e horse apv53deiq9fw .mpeg.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\z9z7rwe horse lpcu5ai3 hot (!) shoes .rar.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\viaz50 wep6b08 horse hot (!) .mpeg.exe
- %HOMEPATH%\templates\gzn4ud7e w6csjja14n1 epyxwn .rar.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\bd1l5ir mnho9y54 7vepaqjm fw58kpr41ob1w .avi.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\z9z7rwe w6csjja14n1 7vepaqjm .mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\z9z7rwe horse ihthd33 .rar.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\nom72kl h93bklf l9hwcs7vvnphd9 glans .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\nom72kl 7vepaqjm .mpg.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\4h1e2a346 7nd83wovj apv53deiq9fw 8pfmdyy (dehod0,y8oxsqa).mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\s2fkave xakmpl sgu4m7oc titts .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\w6csjja14n1 nude sgu4m7oc hotel .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\z1qxwcd tsomq34 [free] titts .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\lpcu5ai3 ihthd33 779mipj .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\7b6fhxi mnho9y54 tsomq34 uncut legs .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\eq7k2xcxt w6csjja14n1 bq4kno gsva2xn .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\upfgetx gay beast big .rar.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\0287zh nom72kl mzwpstr8n uncut nmibe2 .zip.exe
- %WINDIR%\assembly\temp\eq7k2xcxt porn bq4kno hairy (sonja).zip.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\wep6b08 uncut legs fishy (36mho73,36mho73).rar.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\mzwpstr8n horse [milf] ash (jade).mpeg.exe
- %WINDIR%\pla\templates\horse tsomq34 bq4kno ash .mpg.exe
- %WINDIR%\security\templates\wep6b08 porn bq4kno ash mg9fvb2xk9 .mpeg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\horse mzwpstr8n sgu4m7oc ash lady .zip.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\yzw1afy apv53deiq9fw (y8oxsqa).rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\lpcu5ai3 nom72kl [free] ejn547rbxhd1 (36mho73,sonja).rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\ikdyfwhy nude horse l9hwcs7vvnphd9 hairy .rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\z1qxwcd tsomq34 ihthd33 qx2j1b5 (36mho73).mpeg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\0287zh cum 8ok6yf l9hwcs7vvnphd9 ejn547rbxhd1 .rar.exe
- %WINDIR%\syswow64\config\systemprofile\0287zh porn apv53deiq9fw boobs .zip.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\horse ihthd33 young .mpeg.exe
- %WINDIR%\syswow64\fxstmp\ ddqayq big .rar.exe
- %WINDIR%\syswow64\config\systemprofile\7nd83wovj w6csjja14n1 hot (!) .zip.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\asian horse uncut 8bgkvshe1 (jenna,36mho73).avi.exe
- %WINDIR%\syswow64\fxstmp\viaz50 mnho9y54 uncut titts zn3tvn .rar.exe
- %WINDIR%\syswow64\ime\shared\8r3baiec 8ok6yf apv53deiq9fw cock (2hbt8wr).zip.exe
- %WINDIR%\temp\8ok6yf xxx uncut .mpeg.exe
- %WINDIR%\winsxs\installtemp\ikdyfwhy 8ok6yf girls cock zmc8ujp (jenna,rdl1tfkz).mpeg.exe
- <Current directory>\sqjaed7r1vnw
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
