Technical Information
- %TEMP%\9108.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\9108.tmp' --ping<Full path to file> 3DC391F9E8E9FA54F2EB4D1987E10751E5941985A4D22E537CEC47FD2299BC1074D74329890D6554E9ACB5056C16E78A36A1EB6539A24F28E1695FD724CCAD87
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\9108.tmp' --ping<Full path to file> 3DC391F9E8E9FA54F2EB4D1987E10751E5941985A4D22E537CEC47FD2299BC1074D74329890D6554E9ACB5056C16E78A36A1EB6539A24F28E1695FD724CCAD87' (with hidden window)