Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM dwm.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM conhost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\dwm.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM dwm.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM conhost.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM dwm.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM conhost.exe' (with hidden window)
