Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 20A8301983CEFBAA3352A12BF44D899F242303F13F906B1FC8E00D11FE1A84D92C34ADBD1AC53235B60A2A5CCC148CD021C19EF40DF56660A87119442DDBB0B6
- '%TEMP%\1.tmp' --ping<Full path to file> 20A8301983CEFBAA3352A12BF44D899F242303F13F906B1FC8E00D11FE1A84D92C34ADBD1AC53235B60A2A5CCC148CD021C19EF40DF56660A87119442DDBB0B6' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde