Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '360Safetray' = '<SYSTEM32>\safecheck.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '360SafeDep' = '<SYSTEM32>\safecheck.exe'
- <SYSTEM32>\safecheck.exe
- <SYSTEM32>\cmd.exe /c ""c:\DeleteBat.bat" "
- <SYSTEM32>\ssconfig.ini
- C:\DeleteBat.bat
- <SYSTEM32>\safecheck.exe
- 'ji##.alabo.in':80
- 'localhost':1035
- ji##.alabo.in/tongji/ing/mail.asp?id########################################
- DNS ASK ji##.alabo.in
- '<IP-адрес в локальной сети>':1036