Technical Information
Modifies file system
Creates the following files
- %TEMP%\bt4055.bat
- volume{04cb9fa8-51ca-11ee-b2fe-806e6f6e6963}
- volume{04cb9fa8-51ca-11ee-b2fe-806e6f6e6963}\system volume information\tracking.log.tmp
Sets the 'hidden' attribute to the following files
- %TEMP%\bt4055.bat
Deletes the following files
- %WINDIR%\syswow64\aspnet_counters.dll
- %WINDIR%\syswow64\msvcp140_atomic_wait.dll
- %WINDIR%\syswow64\msvcp140_2.dll
- %WINDIR%\syswow64\msvcp140_1.dll
- %WINDIR%\syswow64\msvcp140d.dll
- %WINDIR%\syswow64\msvcp140.dll
- %WINDIR%\syswow64\msvcp120d.dll
- %WINDIR%\syswow64\msvcp120.dll
- %WINDIR%\syswow64\msvcp110d.dll
- %WINDIR%\syswow64\msvcp110.dll
- %WINDIR%\syswow64\msvcp100d.dll
- %WINDIR%\syswow64\msvcm90d.dll
- %WINDIR%\syswow64\msvcp90d.dll
- %WINDIR%\syswow64\msclmd.dll
- %WINDIR%\syswow64\mfcm140u.dll
- %WINDIR%\syswow64\mfcm140.dll
- %WINDIR%\syswow64\mfcm120u.dll
- %WINDIR%\syswow64\mfcm120.dll
- %WINDIR%\syswow64\mfcm110u.dll
- %WINDIR%\syswow64\mfcm110.dll
- %WINDIR%\syswow64\mfcm100u.dll
- %WINDIR%\syswow64\mfcm100.dll
- %WINDIR%\syswow64\msvcp100.dll
- %WINDIR%\syswow64\mfc120jpn.dll
- %WINDIR%\syswow64\msvcr100.dll
- %WINDIR%\syswow64\vcruntime140d.dll
- %WINDIR%\syswow64\vcruntime140.dll
- %WINDIR%\syswow64\vcomp140.dll
- %WINDIR%\syswow64\vcomp120.dll
- %WINDIR%\syswow64\vcomp110.dll
- %WINDIR%\syswow64\vcomp100.dll
- %WINDIR%\syswow64\vccorlib140d.dll
- %WINDIR%\syswow64\vccorlib140.dll
- %WINDIR%\syswow64\vccorlib120d.dll
- %WINDIR%\syswow64\vccorlib120.dll
- %WINDIR%\syswow64\mfc140u.dll
- %WINDIR%\syswow64\msvcp140_codecvt_ids.dll
- %WINDIR%\syswow64\vcamp140.dll
- %WINDIR%\syswow64\vcamp120.dll
- %WINDIR%\syswow64\vcamp110.dll
- %WINDIR%\syswow64\ucrtbased.dll
- %WINDIR%\syswow64\msvcr90d.dll
- %WINDIR%\syswow64\msvcr120d.dll
- %WINDIR%\syswow64\msvcr120.dll
- %WINDIR%\syswow64\msvcr110d.dll
- %WINDIR%\syswow64\msvcr110.dll
- %WINDIR%\syswow64\msvcr100_clr0400.dll
- %WINDIR%\syswow64\vccorlib110.dll
- %WINDIR%\syswow64\msvcr100d.dll
- %WINDIR%\syswow64\mfc140rus.dll
- %WINDIR%\syswow64\mfc140kor.dll
- %WINDIR%\syswow64\mfc140jpn.dll
- %WINDIR%\syswow64\mfc100fra.dll
- %WINDIR%\syswow64\mfc110enu.dll
- %WINDIR%\syswow64\mfc110deu.dll
- %WINDIR%\syswow64\mfc110cht.dll
- %WINDIR%\syswow64\mfc110chs.dll
- %WINDIR%\syswow64\mfc110.dll
- %WINDIR%\syswow64\mfc100u.dll
- %WINDIR%\syswow64\mfc100rus.dll
- %WINDIR%\syswow64\mfc100kor.dll
- %WINDIR%\syswow64\mfc100jpn.dll
- %WINDIR%\syswow64\vfpodbc.dll
- %WINDIR%\syswow64\mfc110fra.dll
- %WINDIR%\syswow64\mfc100esn.dll
- %WINDIR%\syswow64\mfc100enu.dll
- %WINDIR%\syswow64\mfc100deu.dll
- %WINDIR%\syswow64\mfc100cht.dll
- %WINDIR%\syswow64\mfc100chs.dll
- %WINDIR%\syswow64\mfc100.dll
- %WINDIR%\syswow64\concrt140d.dll
- %WINDIR%\syswow64\concrt140.dll
- %WINDIR%\syswow64\atl110.dll
- %WINDIR%\syswow64\atl100.dll
- %WINDIR%\syswow64\mfc100ita.dll
- %WINDIR%\syswow64\vccorlib110d.dll
- %WINDIR%\syswow64\mfc110ita.dll
- %WINDIR%\syswow64\mfc110rus.dll
- %WINDIR%\syswow64\mfc110jpn.dll
- %WINDIR%\syswow64\mfc140ita.dll
- %WINDIR%\syswow64\mfc140fra.dll
- %WINDIR%\syswow64\mfc140esn.dll
- %WINDIR%\syswow64\mfc140enu.dll
- %WINDIR%\syswow64\mfc140deu.dll
- %WINDIR%\syswow64\mfc140cht.dll
- %WINDIR%\syswow64\mfc140chs.dll
- %WINDIR%\syswow64\mfc140.dll
- %WINDIR%\syswow64\mfc120u.dll
- %WINDIR%\syswow64\mfc110kor.dll
- %WINDIR%\syswow64\mfc120rus.dll
- %WINDIR%\syswow64\mfc110esn.dll
- %WINDIR%\syswow64\mfc120ita.dll
- %WINDIR%\syswow64\mfc120fra.dll
- %WINDIR%\syswow64\mfc120esn.dll
- %WINDIR%\syswow64\mfc120enu.dll
- %WINDIR%\syswow64\mfc120deu.dll
- %WINDIR%\syswow64\mfc120cht.dll
- %WINDIR%\syswow64\mfc120chs.dll
- %WINDIR%\syswow64\mfc120.dll
- %WINDIR%\syswow64\mfc110u.dll
- %WINDIR%\syswow64\mfc120kor.dll
- %TEMP%\bt4055.bat
Moves the following files
- from volume{04cb9fa8-51ca-11ee-b2fe-806e6f6e6963}\system volume information\tracking.log.tmp to volume{04cb9fa8-51ca-11ee-b2fe-806e6f6e6963}\system volume information\tracking.log
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt4055.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt4055.bat
- '%WINDIR%\syswow64\format.com' /y /q d
- '%WINDIR%\syswow64\shutdown.exe' -r
Attempts to shut down the Windows operating system.
