Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\taskhostw.exe
- <SYSTEM32>\cmd.exe
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} recoveryenabled No
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} recoveryenabled No' (with hidden window)
