Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'mkl' = '%TEMP%\mkl\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\mkl\svchost.exe' = '%TEMP%\mkl\svchost.exe:*:Enabled:KL'
- %TEMP%\mkl\svchost.exe
- <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run /V "mkl" /D "%TEMP%\mkl\svchost.exe" /F
- [<HKCU>\SOFTWARE\FlashFXP\3]
- [<HKLM>\SOFTWARE\FlashFXP\3]
- %TEMP%\comres
- %TEMP%\mkl\svchost.exe
- %TEMP%\comres
- 'in####b.myjino.ru':80
- DNS ASK in####b.myjino.ru