Техническая информация
- %WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Identities\{D6909BE8-EA09-4677-9635-1238019FCABC}\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Identities\{D6909BE8-EA09-4677-9635-1238019FCABC}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [<HKCU>\Software\Microsoft\MSNMessenger]
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- <LS_APPDATA>\google\chrome\user data\default\login data
- <LS_APPDATA>\chromium\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %TEMP%\d7746509-d744-f8b3-5e42-946cd73e09fc
- %TEMP%\tmp1.tmp
- %TEMP%\tmp1.tmp
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\tmp1.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\tmp2.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\tmp1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\tmp2.tmp"