Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 72F9D7A3236658E992F59DE25D1BBC00EE3100CD3B1EB1CB322BF0EBBADFDC8C89BB53DE71F1F1E3346FB0D4C1E421C93CBB098E982F32033A5EE7933AFD176D
- '%TEMP%\1.tmp' --ping<Full path to file> 72F9D7A3236658E992F59DE25D1BBC00EE3100CD3B1EB1CB322BF0EBBADFDC8C89BB53DE71F1F1E3346FB0D4C1E421C93CBB098E982F32033A5EE7933AFD176D' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde