Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '*Microsoft .NET Framework CAS Policy Manager' = '<Full path to file>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '*Microsoft .NET Framework CAS Policy Manager' = '<Full path to file>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '*Microsoft .NET Framework CAS Policy Manager' = '<Full path to file>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '*Microsoft .NET Framework CAS Policy Manager' = '<Full path to file>'
- %WINDIR%\Tasks\CasPol.job
- '<SYSTEM32>\schtasks.exe' /create /tn CasPol /tr "\"<Full path to file>\" arguments" /sc MINUTE /mo 5 /RU SYSTEM
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- javaw.exe
- java.exe
- <LS_APPDATA>\defragdata\passwordManagerExceptions.xul
- <LS_APPDATA>\defragdata\passwordmgr.css
- <LS_APPDATA>\defragdata\passwordManagerExceptions.js
- <LS_APPDATA>\defragdata\passwordManager.xul
- <LS_APPDATA>\defragdata\passwordManagerCommon.js
- <LS_APPDATA>\defragdata\key-16.png
- <LS_APPDATA>\defragdata\passwords.js
- <LS_APPDATA>\defragdata\password.chm
- <LS_APPDATA>\defragdata\passwordmgr.manifest
- <LS_APPDATA>\defragdata\key-64.png
- <LS_APPDATA>\defragdata\key.png
- <LS_APPDATA>\defragdata\passwordManager.js
- <LS_APPDATA>\defragdata\passwordmgr.properties
- <LS_APPDATA>\defragdata\changepassword.xul
- <LS_APPDATA>\defragdata\folder_passwords.txt
- <Full path to file>:Zone.Identifier
- <LS_APPDATA>\defragdata\passwordManager.dtd
- <LS_APPDATA>\defragdata\getp12password.xul
- <LS_APPDATA>\defragdata\resetpassword.xul
- <LS_APPDATA>\defragdata\setp12password.xul
- <LS_APPDATA>\defragdata\resetpassword.js
- <LS_APPDATA>\defragdata\getpassword.xul
- <LS_APPDATA>\defragdata\password.js