Техническая информация
- [<HKCU>\Software\LinasFTP\Site Manager]
- [<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\mIRC]
- [<HKCU>\Software\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\VanDyke\SecureFX]
- [<HKLM>\Software\WOW6432Node\NCH Software\Fling\Accounts]
- [<HKCU>\Software\NCH Software\Fling\Accounts]
- [<HKLM>\Software\WOW6432Node\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\SimonTatham\PuTTY\Sessions]
- [<HKLM>\Software\WOW6432Node\SimonTatham\PuTTY\Sessions]
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\WOW6432Node\Martin Prikryl]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\524389\98470f.lck
- %APPDATA%\524389\98470f.lck
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1004681136-874170566-1875838749-1001\f58155b4b1d5a524ca0261c3ee99fb50_3a013a80-9fd9-4823-9743-876b68250df0
- из <Полный путь к файлу> в %APPDATA%\524389\98470f.exe
- '14#.#55.36.190':80