Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 0C8C23104687F85E257D588A038B4B96AF35787891487124D724591A7F18D0A75876C75F5582F16C6ACAFDA71EDAAB69B1FC4599DA1E0E715C436C523D059475
- '%TEMP%\1.tmp' --ping<Full path to file> 0C8C23104687F85E257D588A038B4B96AF35787891487124D724591A7F18D0A75876C75F5582F16C6ACAFDA71EDAAB69B1FC4599DA1E0E715C436C523D059475' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde