Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ema0' = 'wscript "%HOMEPATH%\arv0\fic0.vbs"'
- %WINDIR%\win.ini
- fic0.exe
- %HOMEPATH%\arv0\fic0.exe
- %HOMEPATH%\arv0\fic0.vbs
- 'ta####ou.ddns.net':3122
- DNS ASK ta####ou.ddns.net
- '%HOMEPATH%\arv0\fic0.exe'