Technical Information
- %TEMP%\1.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1.tmp' --ping<Full path to file> E8028A7DF832C128A253D6DBF7EC811985700FE90D6B4CA6B8345C2043064A383A6056B5E44038EDD3BC238FAFA03A3521AE3C3AA104516ACE4F168AF180C69D
- '%TEMP%\1.tmp' --ping<Full path to file> E8028A7DF832C128A253D6DBF7EC811985700FE90D6B4CA6B8345C2043064A383A6056B5E44038EDD3BC238FAFA03A3521AE3C3AA104516ACE4F168AF180C69D' (with hidden window)
- '%ProgramFiles%\microsoft office\office12\winword.exe' /n /dde