Technical Information
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "%TEMP%\A9R95nxmc_1i154p3_24c.tmp\clean.docx"
- rdrcef.exe
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
- %TEMP%\a9r95nxmc_1i154p3_24c.tmp\clean.docx
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies-journal
- %TEMP%\etilqs_w0ccvp6twmfspcv
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies
- %TEMP%\a9r2oivxw_1i154p5_24c.tmp