Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> DC03857B76F168F7F35D4F6E4FF18A6FBD5A9EDAC21A473CC5AFC1BC45583EFC32A0CD6DC1365CAA0762CAF9E31F34F451D7866A843DE1A8DC090F14BDE981A5
- '%TEMP%\1.tmp' --ping<Full path to file> DC03857B76F168F7F35D4F6E4FF18A6FBD5A9EDAC21A473CC5AFC1BC45583EFC32A0CD6DC1365CAA0762CAF9E31F34F451D7866A843DE1A8DC090F14BDE981A5' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde