Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\ntvdm.exe' -f -i1b
- '<SYSTEM32>\ntvdm.exe' -f -i1a
- '<SYSTEM32>\ntvdm.exe' -f -i1c
- '<SYSTEM32>\ntvdm.exe' -f -i1e
- '<SYSTEM32>\ntvdm.exe' -f -i1d
- '<SYSTEM32>\ntvdm.exe' -f -i16
- '<SYSTEM32>\ntvdm.exe' -f -i15
- '<SYSTEM32>\ntvdm.exe' -f -i17
- '<SYSTEM32>\ntvdm.exe' -f -i19
- '<SYSTEM32>\ntvdm.exe' -f -i18
- '<SYSTEM32>\ntvdm.exe' -f -i25
- '<SYSTEM32>\ntvdm.exe' -f -i24
- '<SYSTEM32>\ntvdm.exe' -f -i26
- '<SYSTEM32>\shutdown.exe' -s
- '<SYSTEM32>\ntvdm.exe' -f -i27
- '<SYSTEM32>\ntvdm.exe' -f -i20
- '<SYSTEM32>\ntvdm.exe' -f -i1f
- '<SYSTEM32>\ntvdm.exe' -f -i21
- '<SYSTEM32>\ntvdm.exe' -f -i23
- '<SYSTEM32>\ntvdm.exe' -f -i22
- '<SYSTEM32>\ntvdm.exe' -f -i7
- '<SYSTEM32>\ntvdm.exe' -f -i6
- '<SYSTEM32>\ntvdm.exe' -f -i8
- '<SYSTEM32>\ntvdm.exe' -f -ia
- '<SYSTEM32>\ntvdm.exe' -f -i9
- '<SYSTEM32>\ntvdm.exe' -f -i2
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '<SYSTEM32>\ntvdm.exe' -f -i3
- '<SYSTEM32>\ntvdm.exe' -f -i5
- '<SYSTEM32>\ntvdm.exe' -f -i4
- '<SYSTEM32>\ntvdm.exe' -f -i11
- '<SYSTEM32>\ntvdm.exe' -f -i10
- '<SYSTEM32>\ntvdm.exe' -f -i12
- '<SYSTEM32>\ntvdm.exe' -f -i14
- '<SYSTEM32>\ntvdm.exe' -f -i13
- '<SYSTEM32>\ntvdm.exe' -f -ic
- '<SYSTEM32>\ntvdm.exe' -f -ib
- '<SYSTEM32>\ntvdm.exe' -f -id
- '<SYSTEM32>\ntvdm.exe' -f -if
- '<SYSTEM32>\ntvdm.exe' -f -ie
Пытается завершить работу операционной системы Windows.
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\scs34.tmp
- %WINDIR%\Temp\scs35.tmp
- %WINDIR%\Temp\scs32.tmp
- %WINDIR%\Temp\scs33.tmp
- %WINDIR%\Temp\scs37.tmp
- %WINDIR%\Temp\scs39.tmp
- %WINDIR%\Temp\scs3A.tmp
- %WINDIR%\Temp\scs36.tmp
- %WINDIR%\Temp\scs38.tmp
- %WINDIR%\Temp\scs31.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs2B.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs29.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs2F.tmp
- %WINDIR%\Temp\scs30.tmp
- %WINDIR%\Temp\scs2D.tmp
- %WINDIR%\Temp\scs2E.tmp
- %WINDIR%\Temp\scs3B.tmp
- %WINDIR%\Temp\scs48.tmp
- %WINDIR%\Temp\scs49.tmp
- %WINDIR%\Temp\scs45.tmp
- %WINDIR%\Temp\scs47.tmp
- %WINDIR%\Temp\scs4A.tmp
- %WINDIR%\Temp\scs4E.tmp
- %WINDIR%\Temp\scs4D.tmp
- %WINDIR%\Temp\scs4B.tmp
- %WINDIR%\Temp\scs4C.tmp
- %WINDIR%\Temp\scs46.tmp
- %WINDIR%\Temp\scs3E.tmp
- %WINDIR%\Temp\scs3F.tmp
- %WINDIR%\Temp\scs3C.tmp
- %WINDIR%\Temp\scs3D.tmp
- %WINDIR%\Temp\scs40.tmp
- %WINDIR%\Temp\scs43.tmp
- %WINDIR%\Temp\scs44.tmp
- %WINDIR%\Temp\scs41.tmp
- %WINDIR%\Temp\scs42.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs1A.tmp
Удаляет следующие файлы:
- <SYSTEM32>\browseui.dll
- %WINDIR%\Temp\scs38.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs2E.tmp
- %WINDIR%\Temp\scs37.tmp
- %WINDIR%\Temp\scs3B.tmp
- %WINDIR%\Temp\scs36.tmp
- %WINDIR%\Temp\scs2B.tmp
- <SYSTEM32>\browselc.dll
- %WINDIR%\Temp\scs30.tmp
- <SYSTEM32>\browser.dll
- %WINDIR%\Temp\scs2F.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs2D.tmp
- %WINDIR%\Temp\scs32.tmp
- %WINDIR%\Temp\scs33.tmp
- %WINDIR%\Temp\scs3D.tmp
- %WINDIR%\Temp\scs35.tmp
- %WINDIR%\Temp\scs31.tmp
- %WINDIR%\Temp\scs34.tmp
- %WINDIR%\Temp\scs3A.tmp
- %WINDIR%\Temp\scs4E.tmp
- %WINDIR%\Temp\scs48.tmp
- %WINDIR%\Temp\scs49.tmp
- %WINDIR%\Temp\scs3E.tmp
- %WINDIR%\Temp\scs47.tmp
- %WINDIR%\Temp\scs45.tmp
- %WINDIR%\Temp\scs4D.tmp
- %WINDIR%\Temp\scs4B.tmp
- %WINDIR%\Temp\scs4C.tmp
- %WINDIR%\Temp\scs43.tmp
- %WINDIR%\Temp\scs41.tmp
- %WINDIR%\Temp\scs3F.tmp
- %WINDIR%\Temp\scs3C.tmp
- %WINDIR%\Temp\scs40.tmp
- <SYSTEM32>\browsewm.dll
- %WINDIR%\Temp\scs44.tmp
- %WINDIR%\Temp\scs4A.tmp
- %WINDIR%\Temp\scs42.tmp
- %WINDIR%\Temp\scs46.tmp
- %WINDIR%\Temp\scs39.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs29.tmp
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs1D.tmp
Другое:
Ищет следующие окна:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d2c.d30.520013'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d18.d20.510007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d58.d60.54000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d44.d48.530002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cfc.d04.500012'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ccc.cd0.4d000e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cbc.cc0.4c000d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cec.cf0.4f0011'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cdc.ce0.4e000f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d6c.d78.550010'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e18.e1c.5c0014'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e08.e0c.5b0011'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e40.e44.5e0013'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e28.e2c.5d0002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-de8.df4.5a000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-da8.dac.570009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d90.d94.560008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dd8.ddc.59000d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-db8.dc4.58000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ca4.ca8.4b000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b8c.b90.3e000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b7c.b80.3d000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bac.bb0.40000d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b9c.ba0.3f000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b6c.b70.3c0009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b38.b3c.390002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b2c.b30.380001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b58.b60.3b0008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b4c.b50.3a0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bbc.bc0.41000e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c54.c58.48000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c3c.c40.470008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c8c.c90.4a0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c6c.c78.49000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c24.c28.460009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-be4.be8.430007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bcc.bd0.42000f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c0c.c10.450010'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bf4.bf8.440002'
