Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 047CC529EB77A6D1819084F950C618917FB1F83A9D3D96C8FEA11A870710A0FA404CE0B811587C7EBA663670C03A6C02BF2200EC5CB02BA2676C691A21547366
- '%TEMP%\1.tmp' --ping<Full path to file> 047CC529EB77A6D1819084F950C618917FB1F83A9D3D96C8FEA11A870710A0FA404CE0B811587C7EBA663670C03A6C02BF2200EC5CB02BA2676C691A21547366' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde