Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 509DB09E12F6B8B1520FC95F4CE9EE115D4D825592537FE503EB364AAEAFFA0FF42EFFFD074A52D9FCD842DE3B96EC7FEBD4BE7ACC23EA42618409E277E6950C
- '%TEMP%\1.tmp' --ping<Full path to file> 509DB09E12F6B8B1520FC95F4CE9EE115D4D825592537FE503EB364AAEAFFA0FF42EFFFD074A52D9FCD842DE3B96EC7FEBD4BE7ACC23EA42618409E277E6950C' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde