Technical Information
- C:\Documents\user\locals~1\temp\2.tmp
- C:\Documents\user\locals~1\temp\~df87f3.tmp
- C:\Documents\user\locals~1\temp\~df8812.tmp
- C:\Documents\user\locals~1\temp\~df8817.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- 'C:\Documents\user\locals~1\temp\2.tmp' --ping<Full path to file> DCC71894D2561A9AF920A79CFBEE47F40F7640CEC1B658551A2567DEABF0C958DBA64F797C88C3E3D2A8B7275968C19D56912F45E5365A0E93DED291C758A4E1
- 'C:\Documents\user\locals~1\temp\2.tmp' --ping<Full path to file> DCC71894D2561A9AF920A79CFBEE47F40F7640CEC1B658551A2567DEABF0C958DBA64F797C88C3E3D2A8B7275968C19D56912F45E5365A0E93DED291C758A4E1' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde