Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- ClassName: 'Ghost' WindowName: ''
- '%TEMP%\1.tmp' --ping<Full path to file> 5D2C4B754F85138B2713DBEC8E936C4FE04D49C424D310C1836734316112987AC4CB9AFE833E69452E620076726DC2B1CE7CD0084B09A51E03BD6A11D539A48C
- '%TEMP%\1.tmp' --ping<Full path to file> 5D2C4B754F85138B2713DBEC8E936C4FE04D49C424D310C1836734316112987AC4CB9AFE833E69452E620076726DC2B1CE7CD0084B09A51E03BD6A11D539A48C' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde