Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'allus' = '%HOMEPATH%\EXCES\understr.vbs'
- understr.exe
- %HOMEPATH%\exces\understr.exe
- %HOMEPATH%\exces\understr.vbs
- DNS ASK ew#####kuncjo90.club
- '%HOMEPATH%\exces\understr.exe'