Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 54365F5770A5A51BE0D3ED1D432BD3EBD18BF425B3DA685796DF07A95B298F9D9804BF6BDD423CCB00AE0D8D858BA3629CF6861019DB6ECAD6BDBB2324D3F71B
- '%TEMP%\1.tmp' --ping<Full path to file> 54365F5770A5A51BE0D3ED1D432BD3EBD18BF425B3DA685796DF07A95B298F9D9804BF6BDD423CCB00AE0D8D858BA3629CF6861019DB6ECAD6BDBB2324D3F71B' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde