Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- ClassName: 'Ghost' WindowName: ''
- '%TEMP%\1.tmp' --ping<Full path to file> AD84023AF2F141E0294B7F53814C17773FE391EA58AACCC1D7081C7C7A3F06B8AA6BE08064338171FE4A19BD4CF4D867799C12C2D732DF85F0860C03B7CD07BE
- '%TEMP%\1.tmp' --ping<Full path to file> AD84023AF2F141E0294B7F53814C17773FE391EA58AACCC1D7081C7C7A3F06B8AA6BE08064338171FE4A19BD4CF4D867799C12C2D732DF85F0860C03B7CD07BE' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde