Technical Information
- %TEMP%\<File name>.exe
- %TEMP%\rcx5aa.tmp
- <PATH_SAMPLE>.docx
- from %TEMP%\rcx5aa.tmp to %TEMP%\<File name>.exe
- 'we##dns.com':2083
- DNS ASK we##dns.com
- '%TEMP%\<File name>.exe'
- '%TEMP%\<File name>.exe' ' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"