Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> C677A095B61C5C0197CFFB0EA24FDA1755708A1B1D45107F8143633F1C9F97185C4FA8A815EA4A9F8CA9AB6340174816D9C493F49FF39DEF4BFC2498B5EE12EE
- '%TEMP%\1.tmp' --ping<Full path to file> C677A095B61C5C0197CFFB0EA24FDA1755708A1B1D45107F8143633F1C9F97185C4FA8A815EA4A9F8CA9AB6340174816D9C493F49FF39DEF4BFC2498B5EE12EE' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde