Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\dwm.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%y1s2fctrp3
- %CommonProgramFiles%\microsoft shared\z1qxwcd nom72kl [free] lady (36mho73).mpeg.exe
- %ProgramFiles%\dvd maker\shared\gzn4ud7e mzwpstr8n vjq39c1gwy (sonja).avi.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\h93bklf sperm uncut ae2sd7u4xh .mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\jxaglwti wep6b08 girls .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\fac71w2 xxx epyxwn .avi.exe
- %ProgramFiles%\microsoft office\templates\wpjwijv h93bklf hot (!) latex .rar.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\wep6b08 beast bq4kno feet .avi.exe
- %ProgramFiles%\windows journal\templates\black sperm h93bklf epyxwn boobs gsva2xn .zip.exe
- %ProgramFiles%\windows sidebar\shared gadgets\fac71w2 h93bklf nom72kl l9hwcs7vvnphd9 .avi.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\0287zh horse vjq39c1gwy feet rv0y8n .avi.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\gzn4ud7e horse 7vepaqjm cock (liz,sonja).zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\ikdyfwhy nude [bangbus] mg9fvb2xk9 .mpg.exe
- %CommonProgramFiles(x86)%\microsoft shared\ikdyfwhy lpcu5ai3 nude nom72kl ash .avi.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\f07qtt mnho9y54 yzw1afy girls (g6u8n4r).zip.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\viaz50 8ok6yf 8ok6yf big feet rv0y8n .mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\4h1e2a346 [free] jxqgtp .zip.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\wep6b08 7nd83wovj girls nmibe2 .zip.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\fac71w2 lpcu5ai3 vjq39c1gwy .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\wep6b08 bq4kno .zip.exe
- %ALLUSERSPROFILE%\templates\7b6fhxi [bangbus] jxqgtp hotel .zip.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\eq7k2xcxt 7nd83wovj nude vjq39c1gwy glans zn3tvn (dehod0).mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\jxaglwti mzwpstr8n uncut .zip.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\eq7k2xcxt horse uncut hole ol6p1tua .rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\7nd83wovj horse [milf] .mpg.exe
- %ALLUSERSPROFILE%\templates\upfgetx h93bklf uncut boobs wifey (liz,haj1oyikd).mpeg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\fac71w2 sperm gay vjq39c1gwy cock zmc8ujp .rar.exe
- C:\users\default\appdata\local\temp\nude sgu4m7oc .rar.exe
- C:\users\default\appdata\local\<INETFILES>\mzwpstr8n ihthd33 .rar.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\0287zh beast big zn3tvn .avi.exe
- C:\users\default\templates\viaz50 xxx yzw1afy vjq39c1gwy boobs (hyo87il).mpeg.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\sperm lpcu5ai3 [free] hole wifey (36mho73,dehod0).avi.exe
- %TEMP%\wpjwijv bd1l5ir uncut .rar.exe
- %LOCALAPPDATA%\<INETFILES>\black l9hwcs7vvnphd9 jxqgtp boots .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\4h1e2a346 lpcu5ai3 horse [bangbus] (sarah).mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\black bd1l5ir horse nom72kl ash .avi.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\0287zh bd1l5ir vjq39c1gwy .mpg.exe
- %APPDATA%\microsoft\templates\upfgetx w6csjja14n1 big (dehod0).avi.exe
- %APPDATA%\microsoft\windows\templates\f07qtt cum uncut .rar.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\wpjwijv 8ok6yf h93bklf vjq39c1gwy .rar.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\ikdyfwhy xakmpl sgu4m7oc titts .mpg.exe
- %HOMEPATH%\templates\h93bklf epyxwn 8bgkvshe1 .mpg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\xxx nom72kl (g6u8n4r,liz).mpg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\4h1e2a346 gay nude big jxqgtp .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\8ok6yf uncut qq6w54yfhtqrbwcslg .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\zc8giv9 h93bklf epyxwn .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\s2fkave ddqayq beast uncut 40+ .rar.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\horse lpcu5ai3 l9hwcs7vvnphd9 nrb42wq .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\tsomq34 7nd83wovj apv53deiq9fw rv0y8n .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\upfgetx xxx bd1l5ir [milf] young .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\z1qxwcd 7nd83wovj mnho9y54 uncut qx2j1b5 .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\4h1e2a346 bd1l5ir wep6b08 [milf] (g6u8n4r).avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\jxaglwti h93bklf ihthd33 hotel .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\horse w6csjja14n1 [free] ol6p1tua .mpg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\fac71w2 mzwpstr8n gay vjq39c1gwy wifey .mpg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\z1qxwcd xxx uncut 6tl9zg0uqa (sonja).mpg.exe
- %WINDIR%\assembly\temp\f07qtt h93bklf yzw1afy uncut titts qq6w54yfhtqrbwcslg (sandy,liz).rar.exe
- %WINDIR%\assembly\tmp\nude porn l9hwcs7vvnphd9 boobs .mpg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\7b6fhxi gay xakmpl girls titts .rar.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\sperm apv53deiq9fw qq6w54yfhtqrbwcslg (cy4xpd).avi.exe
- %WINDIR%\pla\templates\wep6b08 porn uncut 779mipj .rar.exe
- %WINDIR%\security\templates\wep6b08 big hotel .mpg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\wpjwijv 7nd83wovj uncut qx2j1b5 .mpg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\bd1l5ir uncut lady .avi.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\f07qtt 8ok6yf ihthd33 titts shoes .zip.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\horse sgu4m7oc ash .avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\xxx ihthd33 ash .rar.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\beast apv53deiq9fw legs .zip.exe
- %WINDIR%\syswow64\config\systemprofile\s2fkave xxx lpcu5ai3 vjq39c1gwy wifey .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\8r3baiec porn 7vepaqjm young .rar.exe
- %WINDIR%\syswow64\fxstmp\xxx [milf] .mpg.exe
- %WINDIR%\syswow64\ime\shared\wep6b08 8ok6yf hot (!) (karin,sonja).mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\viaz50 beast nude vjq39c1gwy glans rv0y8n .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\yzw1afy l9hwcs7vvnphd9 nrb42wq (sonja).avi.exe
- %WINDIR%\syswow64\fxstmp\z1qxwcd yzw1afy hot (!) kfp2yqq .avi.exe
- %WINDIR%\syswow64\ime\shared\zc8giv9 sperm horse sgu4m7oc mg9fvb2xk9 .zip.exe
- %WINDIR%\temp\lpcu5ai3 ddqayq epyxwn hole 779mipj .mpeg.exe
- %WINDIR%\winsxs\installtemp\8ok6yf [milf] gsva2xn .rar.exe
- <Current directory>\sqjaed7r1vnw
- %CommonProgramFiles%\microsoft shared\tsomq34 mnho9y54 hot (!) .zip.exe
- %CommonProgramFiles%\microsoft shared\7nd83wovj girls boots .zip.exe
- %ProgramFiles%\dvd maker\shared\viaz50 nom72kl sperm 7vepaqjm sweet .zip.exe
- %ProgramFiles%\dvd maker\shared\nude l9hwcs7vvnphd9 40+ .mpg.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\upfgetx 7nd83wovj apv53deiq9fw .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\w6csjja14n1 nom72kl ash .mpeg.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\jxaglwti nom72kl uncut .rar.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\zc8giv9 xakmpl nude uncut boobs 40+ .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\xxx big .mpeg.exe
- %ProgramFiles%\microsoft office\templates\nom72kl sgu4m7oc .avi.exe
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\zc8giv9 sperm nom72kl (dxocjwba,jenna).mpeg.exe
- %ProgramFiles%\microsoft office\templates\4h1e2a346 porn apv53deiq9fw boobs .rar.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\mnho9y54 apv53deiq9fw .mpeg.exe
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\fac71w2 mzwpstr8n nude bq4kno feet gsva2xn .mpeg.exe
- %ProgramFiles%\windows journal\templates\porn 7vepaqjm .mpeg.exe
- %ProgramFiles%\windows journal\templates\black wep6b08 horse vjq39c1gwy zmc8ujp .mpg.exe
- %ProgramFiles%\windows sidebar\shared gadgets\mzwpstr8n beast girls lzxyhb7k .mpeg.exe
- %ProgramFiles%\windows sidebar\shared gadgets\7nd83wovj cum hot (!) (2hbt8wr,2hbt8wr).zip.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\lpcu5ai3 ddqayq uncut ash (rdl1tfkz).mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\upfgetx cum girls nmibe2 .avi.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\w6csjja14n1 bd1l5ir [free] (jenna,sonja).mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\f1i7cm 8ok6yf apv53deiq9fw .rar.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\jxaglwti beast hot (!) titts 8bgkvshe1 .mpg.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\h93bklf epyxwn boobs .mpeg.exe
- %CommonProgramFiles(x86)%\microsoft shared\nude beast big feet eigt45 .avi.exe
- %CommonProgramFiles(x86)%\microsoft shared\s2fkave yzw1afy bq4kno fishy (36mho73).avi.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\s2fkave mzwpstr8n tsomq34 girls legs 50+ .mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\z9z7rwe nom72kl hot (!) kfp2yqq eigt45 .mpeg.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\horse porn nom72kl gh5b6gd7wrv .zip.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\ [milf] cock .rar.exe
- %ProgramFiles(x86)%\windows sidebar\shared gadgets\jxaglwti 8ok6yf wep6b08 big titts 779mipj .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\eq7k2xcxt horse 7nd83wovj ihthd33 girly .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\cum sgu4m7oc young (2hbt8wr).avi.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\0287zh horse uncut kfp2yqq .rar.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\bd1l5ir l9hwcs7vvnphd9 8bgkvshe1 (jade).rar.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\xakmpl nom72kl .rar.exe
- %ALLUSERSPROFILE%\templates\w6csjja14n1 [free] ash (c4w8hqa).mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\mnho9y54 sperm l9hwcs7vvnphd9 ae2sd7u4xh (hyo87il).mpg.exe
- %ALLUSERSPROFILE%\templates\8ok6yf 7vepaqjm jxqgtp .rar.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\w6csjja14n1 wep6b08 uncut legs fishy .mpg.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\viaz50 8ok6yf xxx sgu4m7oc rv0y8n .mpg.exe
- %ALLUSERSPROFILE%\microsoft\rac\temp\gay uncut cock .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\horse apv53deiq9fw wifey .mpg.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\jxaglwti sperm xxx sgu4m7oc (sonja,sonja).rar.exe
- %ALLUSERSPROFILE%\microsoft\search\data\temp\nom72kl 8ok6yf [bangbus] (y8oxsqa,haj1oyikd).mpg.exe
- %ALLUSERSPROFILE%\templates\eq7k2xcxt 8ok6yf 8ok6yf vjq39c1gwy 40+ .mpeg.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\asian xakmpl bd1l5ir vjq39c1gwy shoes (hyo87il).zip.exe
- %ALLUSERSPROFILE%\microsoft\windows\templates\ikdyfwhy xxx wep6b08 uncut .mpg.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\wpjwijv horse [milf] hotel (dehod0,sandy).avi.exe
- C:\users\default\appdata\local\temp\fac71w2 yzw1afy epyxwn 40+ .zip.exe
- C:\users\default\appdata\local\<INETFILES>\7b6fhxi ddqayq mnho9y54 uncut js80j73 .mpg.exe
- %ALLUSERSPROFILE%\templates\ddqayq cum uncut hotel .avi.exe
- C:\users\default\appdata\local\microsoft\windows\<INETFILES>\z9z7rwe beast sgu4m7oc titts fishy .avi.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\asian bd1l5ir epyxwn legs sgoibhh .avi.exe
- C:\users\default\appdata\local\temp\viaz50 nude horse sgu4m7oc .mpg.exe
- C:\users\default\appdata\local\<INETFILES>\porn ddqayq vjq39c1gwy qq6w54yfhtqrbwcslg .rar.exe
- C:\users\default\templates\nude horse sgu4m7oc hotel (y8oxsqa,y8oxsqa).mpeg.exe
- C:\users\default\appdata\roaming\microsoft\windows\templates\7nd83wovj mnho9y54 sgu4m7oc sweet .zip.exe
- C:\users\default\templates\viaz50 w6csjja14n1 [free] ejn547rbxhd1 (liz,36mho73).zip.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\0287zh 8ok6yf yzw1afy girls jxqgtp 6tl9zg0uqa (gina).zip.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\viaz50 yzw1afy nom72kl hot (!) ash 40+ .rar.exe
- %TEMP%\asian nom72kl xakmpl vjq39c1gwy .zip.exe
- %TEMP%\mnho9y54 w6csjja14n1 7vepaqjm sweet .mpg.exe
- %LOCALAPPDATA%\<INETFILES>\nude horse ihthd33 ejn547rbxhd1 .rar.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\horse bq4kno .mpeg.exe
- %LOCALAPPDATA%\<INETFILES>\wpjwijv ddqayq mzwpstr8n 7vepaqjm 40+ .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\bd1l5ir bq4kno titts ejn547rbxhd1 .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\8ok6yf bd1l5ir sgu4m7oc sm .zip.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\7b6fhxi cum hot (!) qq6w54yfhtqrbwcslg .mpg.exe
- %LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\f07qtt w6csjja14n1 hot (!) qx2j1b5 (sonja).mpeg.exe
- %LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\black ddqayq uncut .rar.exe
- %APPDATA%\microsoft\templates\gzn4ud7e wep6b08 l9hwcs7vvnphd9 .rar.exe
- %APPDATA%\microsoft\templates\horse lpcu5ai3 epyxwn (2hbt8wr,jenna).zip.exe
- %APPDATA%\microsoft\windows\templates\horse cum [milf] zmc8ujp .zip.exe
- %APPDATA%\microsoft\windows\templates\wep6b08 beast uncut balls .zip.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\cum lpcu5ai3 apv53deiq9fw ae2sd7u4xh (haj1oyikd,gina).rar.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\asian horse xakmpl uncut jxqgtp ash .avi.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\porn 7vepaqjm ash .mpeg.exe
- %HOMEPATH%\templates\sperm beast [milf] 8bgkvshe1 (36mho73,g6u8n4r).mpeg.exe
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\viaz50 w6csjja14n1 bd1l5ir nom72kl kfp2yqq .avi.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\mnho9y54 big jxqgtp (karin).zip.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\gay xakmpl l9hwcs7vvnphd9 eigt45 (sonja).rar.exe
- %HOMEPATH%\templates\mzwpstr8n nom72kl 7vepaqjm cock qq6w54yfhtqrbwcslg (sonja,c4w8hqa).rar.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor\ikdyfwhy horse nom72kl sgu4m7oc titts .mpeg.exe
- %WINDIR%\assembly\gac_32\microsoft.grouppolicy.admtmpleditor.resources\7nd83wovj w6csjja14n1 sgu4m7oc latex (sarah).mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\zc8giv9 mzwpstr8n girls .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\7b6fhxi yzw1afy mnho9y54 girls fw58kpr41ob1w (g6u8n4r,g6u8n4r).mpeg.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor\7b6fhxi cum ddqayq girls hairy .avi.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\black horse 7vepaqjm ash lzxyhb7k .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.grouppolicy.admtmpleditor.resources\f1i7cm nom72kl uncut fw58kpr41ob1w .zip.exe
- %WINDIR%\assembly\gac_64\microsoft.sharepoint.businessdata.administration.client\viaz50 xxx wep6b08 bq4kno latex .rar.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\z9z7rwe wep6b08 [free] .avi.exe
- %WINDIR%\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\nom72kl uncut 8pfmdyy .mpg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\upfgetx w6csjja14n1 7nd83wovj [bangbus] .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\sperm [bangbus] gh5b6gd7wrv (jade,dehod0).rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\sperm [milf] .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\temp\zap9e41.tmp\nude xxx big young .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\z1qxwcd gay ihthd33 eigt45 .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\asian mzwpstr8n nom72kl 8bgkvshe1 .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\s2fkave lpcu5ai3 7nd83wovj nom72kl .rar.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\sperm big feet fw58kpr41ob1w .zip.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zap6b8e.tmp\ikdyfwhy xakmpl beast big .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape291.tmp\bd1l5ir wep6b08 vjq39c1gwy boobs ae2sd7u4xh .avi.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\0287zh porn w6csjja14n1 7vepaqjm 40+ .zip.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\asian gay l9hwcs7vvnphd9 sgoibhh .mpeg.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\temp\zape56e.tmp\xakmpl porn [bangbus] 8pfmdyy .mpg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\8r3baiec beast wep6b08 [bangbus] .avi.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\jxaglwti l9hwcs7vvnphd9 .mpg.exe
- %WINDIR%\assembly\temp\h93bklf 7nd83wovj 7vepaqjm wifey (c4w8hqa).avi.exe
- %WINDIR%\assembly\tmp\eq7k2xcxt lpcu5ai3 horse [milf] (karin).mpg.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\temp\asian mnho9y54 uncut boobs mg9fvb2xk9 .zip.exe
- %WINDIR%\assembly\temp\f07qtt nude l9hwcs7vvnphd9 cock (hyo87il,jenna).mpeg.exe
- %WINDIR%\assembly\tmp\ikdyfwhy 8ok6yf apv53deiq9fw (jade).mpeg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\0287zh nom72kl [milf] jxqgtp fishy .avi.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\z1qxwcd 8ok6yf nom72kl cock .mpeg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\temporary asp.net files\xxx horse l9hwcs7vvnphd9 titts shoes (36mho73).mpeg.exe
- %WINDIR%\pla\templates\mzwpstr8n ddqayq vjq39c1gwy .mpeg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\temporary asp.net files\z9z7rwe horse sperm vjq39c1gwy gsva2xn .avi.exe
- %WINDIR%\security\templates\mzwpstr8n vjq39c1gwy .rar.exe
- %WINDIR%\pla\templates\asian mzwpstr8n l9hwcs7vvnphd9 glans nrb42wq .mpg.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\f1i7cm wep6b08 porn uncut hotel (jade,cy4xpd).rar.exe
- %WINDIR%\security\templates\horse nude [free] .avi.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\upfgetx nom72kl mzwpstr8n [bangbus] .avi.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\f07qtt mzwpstr8n w6csjja14n1 epyxwn hole gh5b6gd7wrv (g6u8n4r,haj1oyikd).mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\yzw1afy w6csjja14n1 l9hwcs7vvnphd9 .avi.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\<INETFILES>\8ok6yf lpcu5ai3 apv53deiq9fw .rar.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\temp\gzn4ud7e cum sperm bq4kno nrb42wq (sarah,dxocjwba).avi.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\windows\templates\8r3baiec 8ok6yf mnho9y54 l9hwcs7vvnphd9 young (2hbt8wr).mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\microsoft\windows\<INETFILES>\0287zh nude nude epyxwn mg9fvb2xk9 .mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\wep6b08 [bangbus] feet wifey .avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\temp\horse nom72kl feet (dxocjwba).avi.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\nude nude ihthd33 lzxyhb7k .mpg.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\templates\xxx l9hwcs7vvnphd9 .avi.exe
- %WINDIR%\syswow64\config\systemprofile\beast hot (!) glans 8bgkvshe1 .avi.exe
- %WINDIR%\syswow64\config\systemprofile\horse 7vepaqjm cock sweet .mpg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\7b6fhxi porn [milf] 50+ .zip.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\wep6b08 xakmpl [free] jxqgtp 8bgkvshe1 .rar.exe
- %WINDIR%\syswow64\fxstmp\wpjwijv bd1l5ir bq4kno legs shoes .avi.exe
- %WINDIR%\syswow64\ime\shared\upfgetx mnho9y54 sgu4m7oc .mpg.exe
- %WINDIR%\syswow64\fxstmp\upfgetx beast beast apv53deiq9fw titts .mpeg.exe
- %WINDIR%\syswow64\ime\shared\f1i7cm mzwpstr8n horse uncut .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\jxaglwti nom72kl uncut cock (haj1oyikd,g6u8n4r).rar.exe
- %WINDIR%\syswow64\config\systemprofile\xxx l9hwcs7vvnphd9 hairy .rar.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\mnho9y54 uncut 779mipj .mpeg.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\wep6b08 gay nom72kl .zip.exe
- %WINDIR%\syswow64\fxstmp\f07qtt gay l9hwcs7vvnphd9 sm .mpg.exe
- %WINDIR%\syswow64\fxstmp\xxx gay apv53deiq9fw wifey (sonja).avi.exe
- %WINDIR%\syswow64\ime\shared\wpjwijv horse epyxwn jxqgtp girly (haj1oyikd).rar.exe
- %WINDIR%\temp\wpjwijv horse apv53deiq9fw .mpg.exe
- %WINDIR%\temp\4h1e2a346 ddqayq [milf] 50+ .rar.exe
- %WINDIR%\winsxs\installtemp\yzw1afy uncut hole gsva2xn .zip.exe
- %WINDIR%\winsxs\installtemp\7nd83wovj xakmpl bq4kno zmc8ujp .zip.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'