Technical Information
- %TEMP%\7406.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\7406.tmp' --ping<Full path to file> 7C0D1F161D98B715A11E739268DB371BF912D7DFE288129AEE50EC5009E2CE4395981C34FEF9D95C7E7E01038F13C5D0ABB337E8C785E5B64E6427D22135B087
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\7406.tmp' --ping<Full path to file> 7C0D1F161D98B715A11E739268DB371BF912D7DFE288129AEE50EC5009E2CE4395981C34FEF9D95C7E7E01038F13C5D0ABB337E8C785E5B64E6427D22135B087' (with hidden window)