Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> 9864715D79EA8FFE3E12F3386E5C60918093CE9132284D0152A8E1563C549C859F81CC32B5A4C7AA95ACA55CAC9200CB30EF4FBD178F123A03FB77399CA304C2
- '%TEMP%\1.tmp' --ping<Full path to file> 9864715D79EA8FFE3E12F3386E5C60918093CE9132284D0152A8E1563C549C859F81CC32B5A4C7AA95ACA55CAC9200CB30EF4FBD178F123A03FB77399CA304C2' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde