Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ramel' = 'C:\\Users\\user\\AppData\\Local\\RamelE\\RamelEoWA.hta'
- %WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe
- %LOCALAPPDATA%\ramele\ramel.exe
- %LOCALAPPDATA%\ramele\ramel.vbs
- %LOCALAPPDATA%\ramele\rameleowa.hta
- '21#.#2.228.171':5200
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe'