Technical Information
- %TEMP%\3d1f.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '34.##9.100.209':443
- '%TEMP%\3d1f.tmp' --ping<Full path to file> AC89CE493DD7D191EFF0D3ECB9E779C137A7A6C39BDEC31373996CBA4744ACEFB3407F179FCBC75936061EA958DC1427333562D3D3941090A8010A4415661B67
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\3d1f.tmp' --ping<Full path to file> AC89CE493DD7D191EFF0D3ECB9E779C137A7A6C39BDEC31373996CBA4744ACEFB3407F179FCBC75936061EA958DC1427333562D3D3941090A8010A4415661B67' (with hidden window)