Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 8A709D1F914BA3A4318A352B3D0E7D0C2C84F0ACFAA71F9E02B1779415684394F8B021D9038A0B7138E31A3D679D2F0EBB90E40C64D1C1051D1FFEF2C010A6D2
- '%TEMP%\1.tmp' --ping<Full path to file> 8A709D1F914BA3A4318A352B3D0E7D0C2C84F0ACFAA71F9E02B1779415684394F8B021D9038A0B7138E31A3D679D2F0EBB90E40C64D1C1051D1FFEF2C010A6D2' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde