Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,360updata.exe,'
- C:\360updata.exe (downloaded from the Internet)
- <SYSTEM32>\360updata.exe
- <SYSTEM32>\newkiteupdata.exe
- C:\360updata.exe
- C:\360updata.exe
- 'dk###s.6600.org':80
- dk###s.6600.orghttp://dkddos.6600.org/2/updata.txt
- dk###s.6600.orghttp://dkddos.6600.org/2/kill36022.exe
- DNS ASK dk###s.6600.org
- '<Private IP address>':1035