Technical Information
- %TEMP%\9df7.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\9df7.tmp' --ping<Full path to file> 51425D7080224B8C681E92DC305BBCA0E60D69E7C13D98B3CA8C8433FAE917B94CBBFED7F6FE386FA7D3C9BF9DD2D81B433A7479F2E5E2F05FD03FE6B67B6626
- '%TEMP%\9df7.tmp' --ping<Full path to file> 51425D7080224B8C681E92DC305BBCA0E60D69E7C13D98B3CA8C8433FAE917B94CBBFED7F6FE386FA7D3C9BF9DD2D81B433A7479F2E5E2F05FD03FE6B67B6626' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"