Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 1F7A9FE7AC07D3D907289D739C13BFF4CAD839167AE47FC9A70C1E8FC375A4EA7A4A28CD069B08ADCB563EA901E91CAE112C597C7D3BC52BA9CCC28171374FCC
- '%TEMP%\1.tmp' --ping<Full path to file> 1F7A9FE7AC07D3D907289D739C13BFF4CAD839167AE47FC9A70C1E8FC375A4EA7A4A28CD069B08ADCB563EA901E91CAE112C597C7D3BC52BA9CCC28171374FCC' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde