Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /F /IM IDMan.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\7zipsfx.000\cleanup.cmd
- %TEMP%\7zipsfx.000\permdel.txt
Удаляет следующие файлы
- %TEMP%\7zipsfx.000\permdel.txt
- %TEMP%\7zipsfx.000\cleanup.cmd
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\Cleanup.cmd" "' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\Cleanup.cmd" "
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v LName /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v FName /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v Serial /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v Email /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v LName /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v FName /f
- '%WINDIR%\syswow64\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Internet Download Manager" /f
- '%WINDIR%\syswow64\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Internet Download Manager" /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v Email /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\DownloadManager /v tvfrdt /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\DownloadManager /v scansk /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\DownloadManager /v CheckUpdtVM /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
- '%WINDIR%\syswow64\regini.exe' permdel.txt
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} /f
- '%WINDIR%\syswow64\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v Serial /f
