Техническая информация
- '<LS_APPDATA>\qb07C486.B6\webbrowserpassview.exe' /Stab %TEMP%\Pass.txt
- '<SYSTEM32>\WScript.exe' "<LS_APPDATA>\qb07C486.B6\error.vbs"
- '<SYSTEM32>\timeout.exe' /t 2
- C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\User\0e2ea652-f599-447b-81c3-4641e4b4a575
- <LS_APPDATA>\qb07C486.B6\webbrowserpassview.exe
- C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch
- %TEMP%\Pass.txt
- <LS_APPDATA>\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol
- C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch
- <LS_APPDATA>\qb07C486.B6\blat.exe
- <LS_APPDATA>\qb07C486.B6\blat.dll
- %TEMP%\3956CQTL.bat
- <LS_APPDATA>\qb07C486.B6\blat.lib
- <LS_APPDATA>\qb07C486.B6\WebBrowserPassView.cfg
- <LS_APPDATA>\qb07C486.B6\error.vbs
- <LS_APPDATA>\qb07C486.B6\blatdll.h
- %TEMP%\3956CQTL.bat
- %TEMP%\Pass.txt