Technical Information
- [<HKCU>\software\microsoft\windows\currentversion\run] '<File name>' = 'wscript.exe //B "%APPDATA%\<File name>.js"'
- %APPDATA%\<File name>.js
- 'iv####wkintemo.xyz':80
- http://iv####wkintemo.xyz/dimpan/gate.php
- DNS ASK iv####wkintemo.xyz