Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\nsl8a1c.tmp
- %TEMP%\nsl8b07.tmp\modern-wizard.bmp
- %HOMEPATH%\fevers237\trunnels\euphoria\forlagsretten
- %HOMEPATH%\fevers237\trunnels\euphoria\ageren.unw
- %HOMEPATH%\fevers237\trunnels\euphoria\immunity
- %HOMEPATH%\fevers237\trunnels\euphoria\chimneypot.tri
- %HOMEPATH%\fevers237\trunnels\euphoria\sophically.yol
- %HOMEPATH%\fevers237\trunnels\euphoria\tartaric.jpg
- %HOMEPATH%\fevers237\trunnels\euphoria\theomagics30.jpg
- %HOMEPATH%\fevers237\trunnels\euphoria\typografier.afs
- %HOMEPATH%\fevers237\trunnels\euphoria\underspilninger.jpg
- %HOMEPATH%\fevers237\trunnels\euphoria\yolk57.rej
- %HOMEPATH%\fevers237\trunnels\euphoria\archibaldo.sko
- %HOMEPATH%\fevers237\trunnels\euphoria\bestyrtets.pse
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\countercondemnation.jpg
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\epirhizous.tor
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\fabians.ord
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\fllesknnets.ini
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\formueomstndighederne.txt
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\geomorphogenist.txt
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\halskaede.ryt
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\keros.jpg
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\linieringer.she
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\milder.par
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\notionist.mol
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\outrigger.sel
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\papillate.lns
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\pirned.unc
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\preformulation.ini
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\presound.cha
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\publicans.sca
- %HOMEPATH%\fevers237\trunnels\euphoria\hjtidsdags\remanensen.reg
- %HOMEPATH%\fevers237\trunnels\euphoria\pacificating\sassing.hov
- %HOMEPATH%\fevers237\trunnels\euphoria\pacificating\siphonophorous.knu
- %HOMEPATH%\fevers237\trunnels\euphoria\pacificating\skindbuksers.tan
- %HOMEPATH%\fevers237\trunnels\euphoria\pacificating\subjectivism\slambehandlingerne.jpg
- %HOMEPATH%\fevers237\trunnels\euphoria\pacificating\subjectivism\straffeboksen.byt
- %HOMEPATH%\fevers237\trunnels\euphoria\pacificating\subjectivism\studentersekretren.kry
- %HOMEPATH%\fevers237\trunnels\euphoria\pacificating\subjectivism\synartesis.det
- %HOMEPATH%\fevers237\trunnels\euphoria\shirtingsbindet\tjenestestillings.cre
- %HOMEPATH%\fevers237\trunnels\euphoria\shirtingsbindet\unmalted.cli
- %HOMEPATH%\fevers237\trunnels\euphoria\shirtingsbindet\vaegtning.tva
- %TEMP%\nsl8b07.tmp\system.dll
- %APPDATA%\microsoft\windows\start menu\unaturligt.lnk
- %TEMP%\nsl8b07.tmp\nsexec.dll
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c set /a "146^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "156^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "139^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "151^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "149^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "234^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "235^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "227^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "154^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "171^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "188^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "184^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "173^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "159^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "176^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "181^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "152^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "241^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "180^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "249^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "237^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "245^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "233^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "161^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "225^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "169^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "240^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "247^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "236^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "229^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "143^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "172^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "182^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "186^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "232^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "224^217"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "146^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "156^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "139^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "151^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "149^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "234^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "235^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "227^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "154^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "171^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "188^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "184^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "173^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "159^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "176^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "181^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "152^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "241^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "180^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "249^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "237^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "245^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "233^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "161^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "225^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "169^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "240^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "247^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "236^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "229^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "143^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "172^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "182^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "186^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "232^217"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "224^217"' (with hidden window)
