Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
- %TEMP%\424d.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\424d.tmp' --ping<Full path to file> FC3DD30E31C5A870AEEE5A7559EEE5F0BC54BCFF1F57239CFC00A04116DCE7F46D56CE62331833DEF0105626EDF185FB89DF81E748920D0952881E73727F3E4F
- '%TEMP%\424d.tmp' --ping<Full path to file> FC3DD30E31C5A870AEEE5A7559EEE5F0BC54BCFF1F57239CFC00A04116DCE7F46D56CE62331833DEF0105626EDF185FB89DF81E748920D0952881E73727F3E4F' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"