Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25369' = '<SYSTEM32>\msokle.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{8F2B7BFB-F7A6-6912-E545-D38EAB7960C9}] 'StubPath' = '<SYSTEM32>\msokle.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\msokle.exe
- 'fi##an.com':443
- 'ta##8.com':443
- DNS ASK fi##an.com
- DNS ASK ta##8.com