Техническая информация
- [<HKCU>\Software\LinasFTP\Site Manager]
- [<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\mIRC]
- [<HKCU>\Software\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\VanDyke\SecureFX]
- [<HKLM>\Software\WOW6432Node\NCH Software\Fling\Accounts]
- [<HKCU>\Software\NCH Software\Fling\Accounts]
- [<HKLM>\Software\WOW6432Node\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\SimonTatham\PuTTY\Sessions]
- [<HKLM>\Software\WOW6432Node\SimonTatham\PuTTY\Sessions]
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\WOW6432Node\Martin Prikryl]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
- %TEMP%\nszf090.tmp
- %TEMP%\9poeb234y80iguqg
- %TEMP%\zxbsncog
- %TEMP%\nsef0d0.tmp\rfcqwceo.dll
- %APPDATA%\524389\98470f.hdb
- %APPDATA%\524389\98470f.lck
- %APPDATA%\524389\98470f.exe
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1004681136-874170566-1875838749-1001\f58155b4b1d5a524ca0261c3ee99fb50_3a013a80-9fd9-4823-9743-876b68250df0
- из <Полный путь к файлу> в %APPDATA%\524389\98470f.exe
- http://se#####1-redirect.net/gc15/fre.php
- DNS ASK se#####1-redirect.net