Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\mnmsrvc] 'Start' = '00000002'
- <SYSTEM32>\mnmsrvc.exe
- <SYSTEM32>\mnmsrvc.exe
- ClassName: '#32770' WindowName: 'Windows File Protection'
- <SYSTEM32>\dllcache\mnmsrvc.exe
- <SYSTEM32>\mnmsrvc.exe в <SYSTEM32>\mnmsrvc.exe.bak
- '26###.###taljininsesi.com.cn':80
- '24###.#l-sunan.com.cn':80
- http://24###.#l-sunan.com.cn/update/version.txt
- http://26###.###taljininsesi.com.cn/client_register_av.do?ty####################################
- DNS ASK 26###.###taljininsesi.com.cn
- DNS ASK 24###.#l-sunan.com.cn
- ClassName: '#32770' WindowName: 'Windows ОДјю±Ј»¤'
- ClassName: '#32770' WindowName: 'Windows ????????'