Technical Information
- C:\Documents\user\locals~1\temp\2.tmp
- C:\Documents\user\locals~1\temp\~dfc0ab.tmp
- C:\Documents\user\locals~1\temp\~dfc0ca.tmp
- C:\Documents\user\locals~1\temp\~dfc0cf.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- 'C:\Documents\user\locals~1\temp\2.tmp' --ping<Full path to file> 30D6275A0D2A33951ED1CB2EF73ABA40E28E5BCC8520001B24E25BFA93C64BCA9DEAE33ACA2F87CD88891438EC6E394FEE61672BED0F925B3F0BE64B152F9F8F
- 'C:\Documents\user\locals~1\temp\2.tmp' --ping<Full path to file> 30D6275A0D2A33951ED1CB2EF73ABA40E28E5BCC8520001B24E25BFA93C64BCA9DEAE33ACA2F87CD88891438EC6E394FEE61672BED0F925B3F0BE64B152F9F8F' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde