Trojan.Siggen9.54548

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\NSH4NSD\shell\Open\Command] '' = '"%WINDIR%\pcdrm\NSDHTMViewer.exe" "%1"'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\PcdrmSvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\PcdrmSvc] 'ImagePath' = '%WINDIR%\pcdrm\pcdrmsvc.exe'
[<HKLM>\SYSTEM\CurrentControlSet\Services\NASCADRV64] 'ImagePath' = '%WINDIR%\pcdrm\NASCA64.sys'

Создает следующие сервисы

'PcdrmSvc' %WINDIR%\pcdrm\pcdrmsvc.exe
'NASCADRV64' %WINDIR%\pcdrm\NASCA64.sys

Изменяет следующие исполняемые системные файлы

<SYSTEM32>\atl100.dll
<SYSTEM32>\mfc100u.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcr100.dll

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P1" dir=in action=allow protocol=UDP localport=15035
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P1" dir=out action=allow protocol=UDP localport=15035
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P2" dir=in action=allow protocol=TCP localport=15036
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P2" dir=out action=allow protocol=TCP localport=15036
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P3" dir=in action=allow protocol=TCP localport=15035
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P3" dir=out action=allow protocol=TCP localport=15035
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P4" dir=in action=allow protocol=UDP localport=15036
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P4" dir=out action=allow protocol=UDP localport=15036

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsreeec.tmp
%WINDIR%\pcdrm\patch\nsr495e.sec
%WINDIR%\pcdrm\patch\nsw492e.sec
%WINDIR%\pcdrm\patch\nsh491e.sec
%WINDIR%\pcdrm\patch\nsb4861.sec
%WINDIR%\pcdrm\patch\nsm4851.sec
%WINDIR%\pcdrm\patch\nsl4801.sec
%WINDIR%\pcdrm\patch\nsl4800.sec
%WINDIR%\pcdrm\patch\nsw47f0.sec
%WINDIR%\pcdrm\patch\nsg47df.sec
%WINDIR%\pcdrm\patch\nsl4713.sec
%WINDIR%\pcdrm\patch\nsg46f3.sec
%WINDIR%\pcdrm\patch\nsz4377.sec
%WINDIR%\pcdrm\patch\nsn3ea4.sec
%WINDIR%\pcdrm\patch\nsi3e84.sec
%WINDIR%\pcdrm\patch\nsf3941.sec
%WINDIR%\pcdrm\patch\nss3e73.sec
%WINDIR%\pcdrm\patch\nss3e23.sec
%WINDIR%\pcdrm\patch\nsc3e12.sec
%WINDIR%\pcdrm\patch\nsc3dc3.sec
%WINDIR%\pcdrm\patch\nss3d84.sec
%WINDIR%\pcdrm\patch\nsh3cf6.sec
%WINDIR%\pcdrm\patch\nsm3c78.sec
%WINDIR%\pcdrm\patch\nsr3c48.sec
%WINDIR%\pcdrm\patch\nsw3c18.sec
%WINDIR%\pcdrm\patch\nsg3b1d.sec
%WINDIR%\pcdrm\patch\nsr3b0d.sec
%WINDIR%\pcdrm\patch\nsb3afc.sec
%WINDIR%\pcdrm\patch\nsl3aeb.sec
%WINDIR%\pcdrm\patch\nsl39b2.sec
%WINDIR%\pcdrm\patch\nsq3982.sec
%WINDIR%\pcdrm\patch\nsc3e62.sec
%WINDIR%\pcdrm\patch\nsl3962.sec
%WINDIR%\pcdrm\patch\nsh496f.sec
%WINDIR%\pcdrm\patch\nsn58c2.sec
%WINDIR%\pcdrm\patch\nsh63d0.sec
%WINDIR%\pcdrm\nsd_uninstaller.exe
%PROGRAMDATA%\microsoft\windows\start menu\programs\nsd\nsd_uninstaller.lnk
%WINDIR%\pcdrm\patch\nsd8b4f.sec
%WINDIR%\pcdrm\dump\20200617_pcdrmsvc.log
%WINDIR%\pcdrm\policy\pcdrm.ini
%TEMP%\nsgeefc.tmp\nsprocess.dll
%WINDIR%\pcdrm\patch\nsl853.sec
%WINDIR%\pcdrm\drmtmp\svctmp.reg
%WINDIR%\temp\udda20f.tmp
%WINDIR%\temp\uddb01a.tmp
%WINDIR%\pcdrm\dump\20200617_nschim.log
%WINDIR%\pcdrm\policy\drmsso.dat
%WINDIR%\pcdrm\dump\20200617_nschill.log
%WINDIR%\pcdrm\patch\nsm4990.sec
%WINDIR%\pcdrm\patch\nsm498f.sec
%WINDIR%\pcdrm\patch\nsn58c1.sec
%WINDIR%\pcdrm\patch\nsk51bb.sec
%WINDIR%\pcdrm\patch\nsk51ba.sec
%WINDIR%\pcdrm\patch\nsv51aa.sec
%WINDIR%\pcdrm\patch\nsm4a36.sec
%WINDIR%\pcdrm\patch\nsm4a35.sec
%WINDIR%\pcdrm\patch\nsm49e6.sec
%WINDIR%\pcdrm\patch\nsx49d6.sec
%WINDIR%\pcdrm\patch\nsx49d5.sec
%WINDIR%\pcdrm\patch\nsh49c4.sec
%WINDIR%\pcdrm\patch\nsr49b3.sec
%WINDIR%\pcdrm\patch\nsr49b2.sec
%WINDIR%\pcdrm\patch\nsc49a2.sec
%WINDIR%\pcdrm\patch\nsc49a1.sec
%WINDIR%\pcdrm\patch\nse5be0.sec
%WINDIR%\pcdrm\patch\nsa38d3.sec
%WINDIR%\pcdrm\patch\nsa38d2.sec
%WINDIR%\pcdrm\patch\nsk38c1.sec
%WINDIR%\pcdrm\patch\nsz410.sec
%WINDIR%\pcdrm\patch\nsz40f.sec
%WINDIR%\pcdrm\patch\nsu3ef.sec
%WINDIR%\pcdrm\patch\nse3de.sec
%WINDIR%\pcdrm\patch\nsp3ce.sec
%WINDIR%\pcdrm\patch\nsk3ae.sec
%WINDIR%\pcdrm\patch\nsp37e.sec
%WINDIR%\pcdrm\patch\nsp37d.sec
%WINDIR%\pcdrm\patch\nsu34d.sec
%WINDIR%\pcdrm\patch\nsp32d.sec
%WINDIR%\pcdrm\patch\nsj30c.sec
%WINDIR%\pcdrm\patch\nso2dc.sec
%WINDIR%\pcdrm\patch\nsy193.sec
%WINDIR%\pcdrm\patch\nsu48f.sec
%WINDIR%\pcdrm\patch\nsd163.sec
%WINDIR%\pcdrm\patch\nsiffac.sec
%WINDIR%\pcdrm\patch\nsifec1.sec
%WINDIR%\pcdrm\patch\nsifec0.sec
%WINDIR%\pcdrm\patch\nshfe22.sec
%WINDIR%\pcdrm\patch\nssfdc4.sec
%WINDIR%\pcdrm\nscinstlist.txt
%TEMP%\nsgeefc.tmp\nscinstproc.dll
%WINDIR%\syswow64\nsof621.sec
%TEMP%\drmtmp\drminst.dll
%TEMP%\msvcr100.dll
%TEMP%\msvcp100.dll
%TEMP%\mfc100u.dll
%TEMP%\atl100.dll
%TEMP%\nsgeefc.tmp\system.dll
%WINDIR%\pcdrm\patch\nsyf5.sec
%WINDIR%\pcdrm\patch\nsf51d.sec
%WINDIR%\pcdrm\patch\nsu440.sec
%WINDIR%\pcdrm\patch\nsp55c.sec
%WINDIR%\pcdrm\patch\nsq3892.sec
%WINDIR%\pcdrm\patch\nshafb.sec
%WINDIR%\pcdrm\patch\nsv3814.sec
%WINDIR%\pcdrm\patch\nsf3803.sec
%WINDIR%\pcdrm\patch\nsu2a75.sec
%WINDIR%\pcdrm\patch\nsp2a55.sec
%WINDIR%\pcdrm\patch\nse288f.sec
%WINDIR%\pcdrm\patch\nsz286f.sec
%WINDIR%\pcdrm\patch\nse283f.sec
%WINDIR%\pcdrm\patch\nsefc4.sec
%WINDIR%\pcdrm\patch\nsidbf.sec
%WINDIR%\pcdrm\pcdrmsvc.exe
%WINDIR%\pcdrm\patch\nsscc4.sec
%WINDIR%\pcdrm\patch\nsdc66.sec
%WINDIR%\pcdrm\patch\nsdc17.sec
%WINDIR%\pcdrm\patch\nsib99.sec
%WINDIR%\pcdrm\patch\nsc9f1.sec
%WINDIR%\pcdrm\patch\nsa5ea.sec
%WINDIR%\pcdrm\patch\nsr963.sec
%WINDIR%\pcdrm\patch\nsw933.sec
%WINDIR%\pcdrm\patch\nsg8d4.sec
%WINDIR%\pcdrm\patch\nsb8b4.sec
%WINDIR%\pcdrm\patch\nsb8b3.sec
%WINDIR%\pcdrm\patch\nsg883.sec
%WINDIR%\pcdrm\dump\20200617_convini.log
%WINDIR%\pcdrm\patch\nsb814.sec
%WINDIR%\pcdrm\patch\nsg6ac.sec
%WINDIR%\pcdrm\patch\nsl67c.sec
%WINDIR%\pcdrm\patch\nsq64c.sec
%WINDIR%\pcdrm\patch\nsl62c.sec
%WINDIR%\pcdrm\patch\nsv61b.sec
%WINDIR%\pcdrm\patch\nsq5fb.sec
%WINDIR%\pcdrm\dump\20200617_drmmain.log
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3842f86a08ee11b9b768828cf6f7225d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Удаляет следующие файлы

%TEMP%\atl100.dll
%TEMP%\mfc100u.dll
%TEMP%\msvcp100.dll
%TEMP%\msvcr100.dll
%TEMP%\nsgeefc.tmp\nscinstproc.dll
%TEMP%\nsgeefc.tmp\system.dll
%TEMP%\nsgeefc.tmp\nsprocess.dll
%WINDIR%\temp\udda20f.tmp
%WINDIR%\temp\uddb01a.tmp

Перемещает следующие файлы

%WINDIR%\syswow64\nsof621.sec в %WINDIR%\syswow64\pcdistl.dll
%WINDIR%\pcdrm\patch\nsg47df.sec в %WINDIR%\pcdrm\nsd\policy\polcpsdk.dat
%WINDIR%\pcdrm\patch\nsl4713.sec в %WINDIR%\pcdrm\nsd\policy\polmatch.dat
%WINDIR%\pcdrm\patch\nsg46f3.sec в %WINDIR%\pcdrm\nsd\plugin\nativemsghost.exe
%WINDIR%\pcdrm\patch\nsz4377.sec в %WINDIR%\pcdrm\nsd\plugin\nativemsghost_manifest.json
%WINDIR%\pcdrm\patch\nsn3ea4.sec в %WINDIR%\pcdrm\nscpr.exe
%WINDIR%\pcdrm\patch\nsi3e84.sec в %WINDIR%\pcdrm\termbrk.exe
%WINDIR%\pcdrm\patch\nss3e73.sec в %WINDIR%\pcdrm\f_ntclr_64.dll
%WINDIR%\pcdrm\patch\nsc3e62.sec в %WINDIR%\pcdrm\nsdif4int64.dll
%WINDIR%\pcdrm\patch\nss3e23.sec в %WINDIR%\pcdrm\nsdif4doc64.dll
%WINDIR%\pcdrm\patch\nsc3e12.sec в %WINDIR%\pcdrm\chkswb64.dll
%WINDIR%\pcdrm\patch\nsc3dc3.sec в %WINDIR%\pcdrm\nsdcsprteng64.dll
%WINDIR%\pcdrm\patch\nsa38d2.sec в %WINDIR%\pcdrm\nscpe64.dll
%WINDIR%\pcdrm\patch\nss3d84.sec в %WINDIR%\pcdrm\nsdconvfiles.exe
%WINDIR%\pcdrm\patch\nsm3c78.sec в %WINDIR%\pcdrm\nsdconv64.dll
%WINDIR%\pcdrm\patch\nsr3c48.sec в %WINDIR%\pcdrm\drmlistv64.dll
%WINDIR%\pcdrm\patch\nsw3c18.sec в %WINDIR%\pcdrm\nsdlogininfo.exe
%WINDIR%\pcdrm\patch\nsg3b1d.sec в %WINDIR%\pcdrm\nsdclntif64.dll
%WINDIR%\pcdrm\patch\nsr3b0d.sec в %WINDIR%\pcdrm\nsdif4epe64.dll
%WINDIR%\pcdrm\patch\nsb3afc.sec в %WINDIR%\pcdrm\convini.exe
%WINDIR%\pcdrm\patch\nsl3aeb.sec в %WINDIR%\pcdrm\nscfw.exe
%WINDIR%\pcdrm\patch\nsl39b2.sec в %WINDIR%\pcdrm\msgproc.exe
%WINDIR%\pcdrm\patch\nsq3982.sec в %WINDIR%\pcdrm\drmmsgbx64.dll
%WINDIR%\pcdrm\patch\nsl3962.sec в %WINDIR%\pcdrm\contdpol64.dll
%WINDIR%\pcdrm\patch\nsf3941.sec в %WINDIR%\pcdrm\nscext264.dll
%WINDIR%\pcdrm\patch\nsh3cf6.sec в %WINDIR%\pcdrm\convfton.exe
%WINDIR%\pcdrm\patch\nsa38d3.sec в %WINDIR%\pcdrm\scwrppr64.dll
%WINDIR%\pcdrm\patch\nsw47f0.sec в %WINDIR%\pcdrm\nsd\policy\polcpinfo.dat
%WINDIR%\pcdrm\patch\nsr49b3.sec в %WINDIR%\pcdrm\nsd\conf\0000000000002282.conf
%WINDIR%\pcdrm\patch\nse5be0.sec в %WINDIR%\pcdrm\nsdicons01.dll
%WINDIR%\pcdrm\patch\nsn58c2.sec в %ProgramFiles(x86)%\nasca plugin for mozilla\npnascaplugin.dll
%WINDIR%\pcdrm\patch\nsn58c1.sec в %WINDIR%\pcdrm\policy\poldisk.dat
%WINDIR%\pcdrm\patch\nsk51bb.sec в %WINDIR%\pcdrm\policy\polhnc.dat
%WINDIR%\pcdrm\patch\nsk51ba.sec в %WINDIR%\pcdrm\policy\poldtmp.dat
%WINDIR%\pcdrm\patch\nsv51aa.sec в %WINDIR%\pcdrm\policy\polexp.dat
%WINDIR%\pcdrm\patch\nsm4a36.sec в %WINDIR%\pcdrm\policy\polnew.dat
%WINDIR%\pcdrm\patch\nsm4a35.sec в %WINDIR%\pcdrm\policy\polact.dat
%WINDIR%\pcdrm\patch\nsm49e6.sec в %WINDIR%\pcdrm\policy\poldlg.dat
%WINDIR%\pcdrm\patch\nsx49d6.sec в %WINDIR%\pcdrm\policy\pol3rd.dat
%WINDIR%\pcdrm\patch\nsx49d5.sec в %WINDIR%\pcdrm\nsd\conf\000000000000001e.conf
%WINDIR%\pcdrm\patch\nsl4801.sec в %WINDIR%\pcdrm\nsd\conf\000000000000004f.conf
%WINDIR%\pcdrm\patch\nsl4800.sec в %WINDIR%\pcdrm\nsd\policy\poliflist.dat
%WINDIR%\pcdrm\patch\nsr49b2.sec в %WINDIR%\pcdrm\nsd\conf\0000000000000511.conf
%WINDIR%\pcdrm\patch\nsc49a2.sec в %WINDIR%\pcdrm\nsd\conf\0000000000002546.conf
%WINDIR%\pcdrm\patch\nsc49a1.sec в %WINDIR%\pcdrm\nsd\conf\0000000000010501.conf
%WINDIR%\pcdrm\patch\nsm4990.sec в %WINDIR%\pcdrm\nsd\conf\0000000000011358.conf
%WINDIR%\pcdrm\patch\nsm498f.sec в %WINDIR%\pcdrm\nsd\conf\0000000000011114.conf
%WINDIR%\pcdrm\patch\nsh496f.sec в %WINDIR%\pcdrm\nsd\conf\0000000000010997.conf
%WINDIR%\pcdrm\patch\nsr495e.sec в %WINDIR%\pcdrm\nsd\conf\0000000000002515.conf
%WINDIR%\pcdrm\patch\nsw492e.sec в %WINDIR%\pcdrm\nsd\conf\0000000000002365.conf
%WINDIR%\pcdrm\patch\nsh491e.sec в %WINDIR%\pcdrm\nsd\conf\0000000000002257.conf
%WINDIR%\pcdrm\patch\nsb4861.sec в %WINDIR%\pcdrm\nsd\conf\0000000000000069.conf
%WINDIR%\pcdrm\patch\nsm4851.sec в %WINDIR%\pcdrm\nsd\conf\0000000000000056.conf
%WINDIR%\pcdrm\patch\nsh49c4.sec в %WINDIR%\pcdrm\nsd\conf\0000000000000835.conf
%WINDIR%\pcdrm\patch\nsk38c1.sec в %WINDIR%\pcdrm\nsdif4sp64.dll
%WINDIR%\pcdrm\patch\nsq3892.sec в %WINDIR%\pcdrm\nsdpnif64.dll
%WINDIR%\pcdrm\patch\nsv3814.sec в %WINDIR%\pcdrm\nbid64.dll
%WINDIR%\pcdrm\patch\nsf51d.sec в %WINDIR%\pcdrm\nsdclntif32.dll
%WINDIR%\pcdrm\patch\nsu48f.sec в %WINDIR%\pcdrm\drmutil2.dll
%WINDIR%\pcdrm\patch\nsu440.sec в %WINDIR%\pcdrm\drmmsgbx.dll
%WINDIR%\pcdrm\patch\nsz410.sec в %WINDIR%\pcdrm\contdpol.dll
%WINDIR%\pcdrm\patch\nsz40f.sec в %WINDIR%\pcdrm\nscext2.dll
%WINDIR%\pcdrm\patch\nsu3ef.sec в %WINDIR%\pcdrm\scwrppr.dll
%WINDIR%\pcdrm\patch\nse3de.sec в %WINDIR%\pcdrm\nscpe.dll
%WINDIR%\pcdrm\patch\nsp3ce.sec в %WINDIR%\pcdrm\nsdif4sp32.dll
%WINDIR%\pcdrm\patch\nsk3ae.sec в %WINDIR%\pcdrm\nsdpnif.dll
%WINDIR%\pcdrm\patch\nsp37e.sec в %WINDIR%\pcdrm\nbid.dll
%WINDIR%\pcdrm\patch\nsa5ea.sec в %WINDIR%\pcdrm\nsdconv.dll
%WINDIR%\pcdrm\patch\nsp37d.sec в %WINDIR%\pcdrm\nfd02.dll
%WINDIR%\pcdrm\patch\nsp32d.sec в %WINDIR%\pcdrm\nsdcpsdk.dll
%WINDIR%\pcdrm\patch\nsj30c.sec в %WINDIR%\pcdrm\nsdcsproccb.dll
%WINDIR%\pcdrm\patch\nso2dc.sec в %WINDIR%\pcdrm\drmnsc06.dll
%WINDIR%\pcdrm\patch\nsy193.sec в %WINDIR%\pcdrm\drmnsc05.dll
%WINDIR%\pcdrm\patch\nsd163.sec в %WINDIR%\pcdrm\nsccor06.dll
%WINDIR%\pcdrm\patch\nsyf5.sec в %WINDIR%\pcdrm\nsccor05.dll
%WINDIR%\pcdrm\patch\nsiffac.sec в %WINDIR%\pcdrm\nsccor03.dll
%WINDIR%\pcdrm\patch\nsifec1.sec в %WINDIR%\pcdrm\nsccor01.dll
%WINDIR%\pcdrm\patch\nsifec0.sec в %WINDIR%\pcdrm\nscbc.dll
%WINDIR%\pcdrm\patch\nshfe22.sec в %WINDIR%\pcdrm\drmrcstr.dat
%WINDIR%\pcdrm\patch\nssfdc4.sec в %WINDIR%\pcdrm\nasca_+sd_client open source license.pdf
%WINDIR%\pcdrm\patch\nsu34d.sec в %WINDIR%\pcdrm\nfd01.dll
%WINDIR%\pcdrm\patch\nsq5fb.sec в %WINDIR%\pcdrm\nsdif4epe32.dll
%WINDIR%\pcdrm\patch\nsp55c.sec в %WINDIR%\pcdrm\drmlistv.dll
%WINDIR%\pcdrm\patch\nsv61b.sec в %WINDIR%\pcdrm\chkepnfo.exe
%WINDIR%\pcdrm\patch\nsf3803.sec в %WINDIR%\pcdrm\nfd0264.dll
%WINDIR%\pcdrm\patch\nshafb.sec в %WINDIR%\pcdrm\nsccor0364.dll
%WINDIR%\pcdrm\patch\nsu2a75.sec в %WINDIR%\pcdrm\nfd0164.dll
%WINDIR%\pcdrm\patch\nsp2a55.sec в %WINDIR%\pcdrm\nsdcpsdk64.dll
%WINDIR%\pcdrm\patch\nse288f.sec в %WINDIR%\pcdrm\nsdcsproccb64.dll
%WINDIR%\pcdrm\patch\nsz286f.sec в %WINDIR%\pcdrm\drmnsc0664.dll
%WINDIR%\pcdrm\patch\nse283f.sec в %WINDIR%\pcdrm\drmnsc0564.dll
%WINDIR%\pcdrm\patch\nsefc4.sec в %WINDIR%\pcdrm\drmmain.exe
%WINDIR%\pcdrm\patch\nsidbf.sec в %WINDIR%\pcdrm\nschill.exe
%WINDIR%\pcdrm\patch\nsscc4.sec в %WINDIR%\pcdrm\convutil64.dll
%WINDIR%\pcdrm\patch\nsdc66.sec в %WINDIR%\pcdrm\drmnsc03.dll
%WINDIR%\pcdrm\patch\nsdc17.sec в %WINDIR%\pcdrm\nsccor0664.dll
%WINDIR%\pcdrm\patch\nsib99.sec в %WINDIR%\pcdrm\nsccor0564.dll
%WINDIR%\pcdrm\patch\nsc9f1.sec в %WINDIR%\pcdrm\nsccor0164.dll
%WINDIR%\pcdrm\patch\nsl62c.sec в %WINDIR%\pcdrm\convutil.dll
%WINDIR%\pcdrm\patch\nsr963.sec в %WINDIR%\pcdrm\nschim.exe
%WINDIR%\pcdrm\patch\nsw933.sec в %WINDIR%\pcdrm\nasca64.sys
%WINDIR%\pcdrm\patch\nsg8d4.sec в %WINDIR%\pcdrm\nasca32.sys
%WINDIR%\pcdrm\patch\nsb8b4.sec в %WINDIR%\pcdrm\nsdif4int32.dll
%WINDIR%\pcdrm\patch\nsb8b3.sec в %WINDIR%\pcdrm\nsdif4doc32.dll
%WINDIR%\pcdrm\patch\nsg883.sec в %WINDIR%\pcdrm\chkswb.dll
%WINDIR%\pcdrm\patch\nsl853.sec в %WINDIR%\pcdrm\nsdcsprteng.dll
%WINDIR%\pcdrm\patch\nsb814.sec в %WINDIR%\pcdrm\nedtray.exe
%WINDIR%\pcdrm\patch\nsg6ac.sec в %WINDIR%\pcdrm\nedlogin.exe
%WINDIR%\pcdrm\patch\nsl67c.sec в %WINDIR%\pcdrm\nsdhtmviewer.exe
%WINDIR%\pcdrm\patch\nsq64c.sec в %WINDIR%\pcdrm\f_ntclr.dll
%WINDIR%\pcdrm\patch\nsh63d0.sec в %WINDIR%\pcdrm\workpfv3.dll
%WINDIR%\pcdrm\patch\nsd8b4f.sec в %WINDIR%\pcdrm\nsdicons0164.dll

Подменяет следующие файлы

%TEMP%\atl100.dll
%TEMP%\mfc100u.dll
%TEMP%\msvcp100.dll
%TEMP%\msvcr100.dll

Другое

Создает и запускает на исполнение

'%WINDIR%\pcdrm\nscpr.exe'
'%WINDIR%\pcdrm\drmmain.exe'
'%WINDIR%\pcdrm\nschim.exe'
'%WINDIR%\pcdrm\pcdrmsvc.exe' /install
'%WINDIR%\pcdrm\convini.exe' /V=5.00 /B=2020021722
'%WINDIR%\pcdrm\convini.exe' /SetDrmIcon
'%WINDIR%\pcdrm\nschill.exe'
'%WINDIR%\pcdrm\pcdrmsvc.exe'
'%WINDIR%\pcdrm\nscfw.exe' 1592377721
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P1" dir=in action=allow protocol=UDP localport=15035' (со скрытым окном)
'%WINDIR%\pcdrm\nscpr.exe' ' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P4" dir=out action=allow protocol=UDP localport=15036' (со скрытым окном)
'%WINDIR%\pcdrm\nschim.exe' ' (со скрытым окном)
'%WINDIR%\pcdrm\nscfw.exe' 1592377721' (со скрытым окном)
'%WINDIR%\pcdrm\drmmain.exe' ' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P2" dir=out action=allow protocol=TCP localport=15036' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P3" dir=out action=allow protocol=TCP localport=15035' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P3" dir=in action=allow protocol=TCP localport=15035' (со скрытым окном)
'%WINDIR%\syswow64\net.exe' start PcdrmSvc' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P2" dir=in action=allow protocol=TCP localport=15036' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P1" dir=out action=allow protocol=UDP localport=15035' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PC-DRM-P4" dir=in action=allow protocol=UDP localport=15036' (со скрытым окном)
'%WINDIR%\pcdrm\nschill.exe' ' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\pcdrm\nsdicons01.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\pcdrm\WorkPFV3.DLL"
'<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\pcdrm\nsdicons0164.dll"
'%WINDIR%\syswow64\net.exe' start PcdrmSvc
'%WINDIR%\syswow64\net1.exe' start PcdrmSvc

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней