Technical Information
- %TEMP%\6566.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\6566.tmp' --ping<Full path to file> F1E18BD525A8F03DBFD6A5AF106589CAD154EBF913FA0773AD1318DDEC43F78DF5826A9D588D11ABDDCDC307F67DBEA60A80451C77DCB5A255B3301B0A98C253
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\6566.tmp' --ping<Full path to file> F1E18BD525A8F03DBFD6A5AF106589CAD154EBF913FA0773AD1318DDEC43F78DF5826A9D588D11ABDDCDC307F67DBEA60A80451C77DCB5A255B3301B0A98C253' (with hidden window)