Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 7797689AE273AFE5DECE8E6335B4E1A44CAD838C1990E5E0D6B3A34BF2FDEAD0FAF6D20ECA5BBA797C40DAD44E4053D8A5338DDE894F699174BF8859D98BDCF4
- '%TEMP%\1.tmp' --ping<Full path to file> 7797689AE273AFE5DECE8E6335B4E1A44CAD838C1990E5E0D6B3A34BF2FDEAD0FAF6D20ECA5BBA797C40DAD44E4053D8A5338DDE894F699174BF8859D98BDCF4' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde