Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> A0A947F5389291B1A8EBDE38F3C8B97C2F01AEE454BBAD6DB8A44C31DB4FC7C1A0A3CC100E62BE006FAD968D9E2854BBBEFF41B3720C84AA150D7DCB224B0CE6
- '%TEMP%\1.tmp' --ping<Full path to file> A0A947F5389291B1A8EBDE38F3C8B97C2F01AEE454BBAD6DB8A44C31DB4FC7C1A0A3CC100E62BE006FAD968D9E2854BBBEFF41B3720C84AA150D7DCB224B0CE6' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde