Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Wxyabc Efghijkl Nop] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Wxyabc Efghijkl Nop] 'ImagePath' = '%ProgramFiles%\Arrange\Null.jpg'
- %ProgramFiles%\arrange\null.jpg
- DNS ASK bb##.net
- '%ProgramFiles%\arrange\null.jpg'