Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 81CA3846526AA800AE8C27351A6AA6EB200B00327FC5B57A5B7542685BE6B3CE3B69898A3BC9D98E8D5FED952C8EF9D3D298581841205080BDCA4918C0A8EA38
- '%TEMP%\1.tmp' --ping<Full path to file> 81CA3846526AA800AE8C27351A6AA6EB200B00327FC5B57A5B7542685BE6B3CE3B69898A3BC9D98E8D5FED952C8EF9D3D298581841205080BDCA4918C0A8EA38' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde