Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 4F0233F63F2D69795CF796417A4B6A779A57EB2B0C77B40BE6A5C99E368FDED9AE7E0117D5AF7DA10DD884B73DD08E9ACDCDC2C4F58FC9B97A81260C0BA66F85
- '%TEMP%\1.tmp' --ping<Full path to file> 4F0233F63F2D69795CF796417A4B6A779A57EB2B0C77B40BE6A5C99E368FDED9AE7E0117D5AF7DA10DD884B73DD08E9ACDCDC2C4F58FC9B97A81260C0BA66F85' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde