Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> AAC0B259A7C3A21FC75EA1D69B173279D04016EA260DAF4B5D3CAAAE6E3D40F9E23855A90F3F930226628B95FC8E8435AED3226CB49A8B2CCF72E18106446680
- '%TEMP%\1.tmp' --ping<Full path to file> AAC0B259A7C3A21FC75EA1D69B173279D04016EA260DAF4B5D3CAAAE6E3D40F9E23855A90F3F930226628B95FC8E8435AED3226CB49A8B2CCF72E18106446680' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde