Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'PHIME2006A' = '<SYSTEM32>\TINTSETUP.exe'
- '<SYSTEM32>\ftp.exe' -s:%WINDIR%\fs.txt
- 360tray.exe
- %WINDIR%\lb.txt
- %WINDIR%\fs.txt
- '22#.#38.195.113':21
- 'localhost':59098
- DNS ASK dn#.##ftncsi.com