Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'val0' = 'wscript "%HOMEPATH%\dow0\fra0.vbs"'
- %WINDIR%\win.ini
- fra0.exe
- %HOMEPATH%\dow0\fra0.exe
- %HOMEPATH%\dow0\fra0.vbs
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
- DNS ASK mo#####s.duckdns.org
- '%HOMEPATH%\dow0\fra0.exe'