Техническая информация
- Процесс powershell.exe, модуль ntdll.dll
- %TEMP%\moviedom230\ringspinderne.eks
- %TEMP%\moviedom230\devenustate\accorder\uncoincidental\incurvity.eft
- %TEMP%\moviedom230\radiologist\heptarchist\microtine76.txt
- %TEMP%\moviedom230\overenstemmelse\conferree\emption\metropolis\indhuggene.sex
- %TEMP%\moviedom230\overenstemmelse\conferree\emption\metropolis\syringitis.sei
- %WINDIR%\syswow64\psiloses.lnk
- %TEMP%\nsna8b0.tmp\nsexec.dll
- %TEMP%\brookier.exe
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle hidden "$Matines=Get-Content '%TEMP%\Moviedom230\Devenustate\Accorder\Uncoincidental\Incurvity.eft';$Intensities=$Matines.SubString(15241,3);.$Intensities($Matines)" (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "set /A 1^^0"