Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 6834E589D56D780DFB8485744E8AB019B7ACC1658B469C4F16F06A71D203A358BF208CA2F4FA5137DDEAC46F4E30E415FC61902D37A5AB8ECC95AD45372281CB
- '%TEMP%\1.tmp' --ping<Full path to file> 6834E589D56D780DFB8485744E8AB019B7ACC1658B469C4F16F06A71D203A358BF208CA2F4FA5137DDEAC46F4E30E415FC61902D37A5AB8ECC95AD45372281CB' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde