Technical Information
- %TEMP%\667f.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\667f.tmp' --ping<Full path to file> FC322C99BFCB2B08BB6F3383BE9E29CDF2893FC4E069656FDB8B88314DD25DBA61A15A5A1175A4E07F15515FBC8D6B85524FFDBD37B7302E8C5F3661FF87C371
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\667f.tmp' --ping<Full path to file> FC322C99BFCB2B08BB6F3383BE9E29CDF2893FC4E069656FDB8B88314DD25DBA61A15A5A1175A4E07F15515FBC8D6B85524FFDBD37B7302E8C5F3661FF87C371' (with hidden window)