Техническая информация
- %TEMP%\Sais\T1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\client_settings_3[1].bin
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\ver2[1].php4
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\6e549e6605dc34d14ae6f5ce06712580_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\a18ca4003deb042bbee7a40f15e1970b_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %APPDATA%\Microsoft\Protect\S-1-5-21-1275210071-117609710-1801674531-500\79f653ba-ec16-44ab-b144-e0eb7b466831
- %TEMP%\Sais\index.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\notify[1].php
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\6e549e6605dc34d14ae6f5ce06712580_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\notify[1].php
- 'ca#####ns.outerinfo.com':80
- 'www.cl###spring.net':80
- 'localhost':1035
- 'nf.###ckspring.net':80
- www.cl###spring.net/pop4/ver2.php4?v=###################################
- ca#####ns.outerinfo.com/client_settings_3.bin
- nf.###ckspring.net/notify.php?pi##############################################################################
- DNS ASK www.cl###spring.net
- DNS ASK ca#####ns.outerinfo.com
- DNS ASK nf.###ckspring.net