Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RemoteSupport' = '%APPDATA%\RemoteSupport\RemoteSupport.exe'
- '%APPDATA%\RemoteSupport\RemoteSupport.exe'
- %APPDATA%\RemoteSupport\RemoteSupport.exe
- %APPDATA%\RemoteSupport\RemoteSupport.exe
- 'al###dyer.com':8080
- 'fr###eoip.net':80
- fr###eoip.net/xml/
- DNS ASK al###dyer.com
- DNS ASK fr###eoip.net