Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Rs5' = 'wscript "%HOMEPATH%\kul\Sub.vbs"'
- %WINDIR%\win.ini
- sub.exe
- %HOMEPATH%\kul\sub.exe
- %HOMEPATH%\kul\sub.vbs
- 'ip##pi.com':80
- http://ip##pi.com/json/
- DNS ASK ip##pi.com
- '%HOMEPATH%\kul\sub.exe'