Technical Information
- %TEMP%\69aa.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- '%TEMP%\69aa.tmp' --ping<Full path to file> 84970904F496F794182D8CAECD1C17AC5FB11DE3A76309EE7BE43B77CB6B4A553227945D125189C86968FC6E9FCB512F9561BE3849952BC08DFFC23374CC67E3
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\69aa.tmp' --ping<Full path to file> 84970904F496F794182D8CAECD1C17AC5FB11DE3A76309EE7BE43B77CB6B4A553227945D125189C86968FC6E9FCB512F9561BE3849952BC08DFFC23374CC67E3' (with hidden window)