Technical Information
- '%TEMP%\vmware-usbarbitrator-36775.vm' (downloaded from the Internet)
- '%TEMP%\vmware-usbarbitrator-26775.vm' (downloaded from the Internet)
- '%TEMP%\vmware-usbarbitrator-26775.vm'
- '%TEMP%\vmware-usbarbitrator-36775.vm'
- '%ProgramFiles%\Windows NT\Accessories\wordpad.exe' "%TEMP%\<File name>.doc"
- '%TEMP%\q_1.tmp'
- %TEMP%\vmware-usbarbitrator-36775.vm
- %TEMP%\ms1813.tmp
- %TEMP%\vmware-usbarbitrator-26775.vm
- %TEMP%\<File name>.doc
- %TEMP%\q_1.tmp
- from <Full path to file> to <Current directory>\<File name>.doc
- '11#.#8.32.12':80
- http://11#.#8.32.12//2/?r=##################
- http://11#.#8.32.12//3/?r=##################
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''