Technical Information
- '<SYSTEM32>\wscript.exe' //e:vbscript //b %APPDATA%\Microsoft\Templates\1589989024.xml
- <Current directory>\~wrd0000.tmp
- %APPDATA%\microsoft\templates\~wrd0002.tmp
- %APPDATA%\microsoft\templates\1589989024.xml
- %APPDATA%\microsoft\templates\~$89989024.xml
- %APPDATA%\microsoft\templates\~$89989024.xml
- from %APPDATA%\microsoft\templates\~wrd0002.tmp to %APPDATA%\microsoft\templates\1589989024.xml
- <PATH_SAMPLE>.doc
- 'bi##f.org':80
- DNS ASK bi##f.org