Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /IM explorer.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mspaint.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM netstat.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM telnet.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM notepad.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM wmplayer.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM iexplore.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mplayer2.exe /F
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\explorer.exe
следующие пользовательские процессы:
- iexplore.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\bt11227.bat
Присваивает атрибут 'скрытый' для следующих файлов
- %TEMP%\bt11227.bat
Удаляет следующие файлы
- %WINDIR%\syswow64\aspnet_counters.dll
- %WINDIR%\syswow64\msvcp140_atomic_wait.dll
- %WINDIR%\syswow64\msvcp140_2.dll
- %WINDIR%\syswow64\msvcp140_1.dll
- %WINDIR%\syswow64\msvcp140d.dll
- %WINDIR%\syswow64\msvcp140.dll
- %WINDIR%\syswow64\msvcp120d.dll
- %WINDIR%\syswow64\msvcp120.dll
- %WINDIR%\syswow64\msvcp110d.dll
- %WINDIR%\syswow64\msvcp110.dll
- %WINDIR%\syswow64\msvcp100d.dll
- %WINDIR%\syswow64\msvcm90d.dll
- %WINDIR%\syswow64\msvcp90d.dll
- %WINDIR%\syswow64\msclmd.dll
- %WINDIR%\syswow64\mfcm140u.dll
- %WINDIR%\syswow64\mfcm140.dll
- %WINDIR%\syswow64\mfcm120u.dll
- %WINDIR%\syswow64\mfcm120.dll
- %WINDIR%\syswow64\mfcm110u.dll
- %WINDIR%\syswow64\mfcm110.dll
- %WINDIR%\syswow64\mfcm100u.dll
- %WINDIR%\syswow64\mfcm100.dll
- %WINDIR%\syswow64\msvcp100.dll
- %WINDIR%\syswow64\mfc120jpn.dll
- %WINDIR%\syswow64\msvcr100.dll
- %WINDIR%\syswow64\vcruntime140d.dll
- %WINDIR%\syswow64\vcruntime140.dll
- %WINDIR%\syswow64\vcomp140.dll
- %WINDIR%\syswow64\vcomp120.dll
- %WINDIR%\syswow64\vcomp110.dll
- %WINDIR%\syswow64\vcomp100.dll
- %WINDIR%\syswow64\vccorlib140d.dll
- %WINDIR%\syswow64\vccorlib140.dll
- %WINDIR%\syswow64\vccorlib120d.dll
- %WINDIR%\syswow64\vccorlib120.dll
- %WINDIR%\syswow64\mfc140u.dll
- %WINDIR%\syswow64\msvcp140_codecvt_ids.dll
- %WINDIR%\syswow64\vcamp140.dll
- %WINDIR%\syswow64\vcamp120.dll
- %WINDIR%\syswow64\vcamp110.dll
- %WINDIR%\syswow64\ucrtbased.dll
- %WINDIR%\syswow64\msvcr90d.dll
- %WINDIR%\syswow64\msvcr120d.dll
- %WINDIR%\syswow64\msvcr120.dll
- %WINDIR%\syswow64\msvcr110d.dll
- %WINDIR%\syswow64\msvcr110.dll
- %WINDIR%\syswow64\msvcr100_clr0400.dll
- %WINDIR%\syswow64\vccorlib110.dll
- %WINDIR%\syswow64\msvcr100d.dll
- %WINDIR%\syswow64\mfc140rus.dll
- %WINDIR%\syswow64\mfc140kor.dll
- %WINDIR%\syswow64\mfc140jpn.dll
- %WINDIR%\syswow64\mfc100fra.dll
- %WINDIR%\syswow64\mfc110enu.dll
- %WINDIR%\syswow64\mfc110deu.dll
- %WINDIR%\syswow64\mfc110cht.dll
- %WINDIR%\syswow64\mfc110chs.dll
- %WINDIR%\syswow64\mfc110.dll
- %WINDIR%\syswow64\mfc100u.dll
- %WINDIR%\syswow64\mfc100rus.dll
- %WINDIR%\syswow64\mfc100kor.dll
- %WINDIR%\syswow64\mfc100jpn.dll
- %WINDIR%\syswow64\vfpodbc.dll
- %WINDIR%\syswow64\mfc110fra.dll
- %WINDIR%\syswow64\mfc100esn.dll
- %WINDIR%\syswow64\mfc100enu.dll
- %WINDIR%\syswow64\mfc100deu.dll
- %WINDIR%\syswow64\mfc100cht.dll
- %WINDIR%\syswow64\mfc100chs.dll
- %WINDIR%\syswow64\mfc100.dll
- %WINDIR%\syswow64\concrt140d.dll
- %WINDIR%\syswow64\concrt140.dll
- %WINDIR%\syswow64\atl110.dll
- %WINDIR%\syswow64\atl100.dll
- %WINDIR%\syswow64\mfc100ita.dll
- %WINDIR%\syswow64\vccorlib110d.dll
- %WINDIR%\syswow64\mfc110ita.dll
- %WINDIR%\syswow64\mfc110rus.dll
- %WINDIR%\syswow64\mfc110jpn.dll
- %WINDIR%\syswow64\mfc140ita.dll
- %WINDIR%\syswow64\mfc140fra.dll
- %WINDIR%\syswow64\mfc140esn.dll
- %WINDIR%\syswow64\mfc140enu.dll
- %WINDIR%\syswow64\mfc140deu.dll
- %WINDIR%\syswow64\mfc140cht.dll
- %WINDIR%\syswow64\mfc140chs.dll
- %WINDIR%\syswow64\mfc140.dll
- %WINDIR%\syswow64\mfc120u.dll
- %WINDIR%\syswow64\mfc110kor.dll
- %WINDIR%\syswow64\mfc120rus.dll
- %WINDIR%\syswow64\mfc110esn.dll
- %WINDIR%\syswow64\mfc120ita.dll
- %WINDIR%\syswow64\mfc120fra.dll
- %WINDIR%\syswow64\mfc120esn.dll
- %WINDIR%\syswow64\mfc120enu.dll
- %WINDIR%\syswow64\mfc120deu.dll
- %WINDIR%\syswow64\mfc120cht.dll
- %WINDIR%\syswow64\mfc120chs.dll
- %WINDIR%\syswow64\mfc120.dll
- %WINDIR%\syswow64\mfc110u.dll
- %WINDIR%\syswow64\mfc120kor.dll
- %TEMP%\bt11227.bat
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt11227.bat "<Полный путь к файлу>" (со скрытым окном)
