Technical Information
- %TEMP%\99a0.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\99a0.tmp' --ping<Full path to file> 7EF53442D2B1990DBF0D36BC5CFF13262C1871CA0F904D64118E356555BDB5A0329265337D4E19C0AD2C7BE9332DA46CA011DF6D53839845EBAF5F9CB8978245
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\99a0.tmp' --ping<Full path to file> 7EF53442D2B1990DBF0D36BC5CFF13262C1871CA0F904D64118E356555BDB5A0329265337D4E19C0AD2C7BE9332DA46CA011DF6D53839845EBAF5F9CB8978245' (with hidden window)