Technical Information
- %TEMP%\d3a3.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\d3a3.tmp' --ping<Full path to file> 1C9FE460EB7C904F86653605E5BEC15D4C23DBEDDB8B9D7A9281F16BE30524964D2E422E405CC23F06389EDA78E5FC5EA1170957603DBFA0E5E91D08DCE2464C
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\d3a3.tmp' --ping<Full path to file> 1C9FE460EB7C904F86653605E5BEC15D4C23DBEDDB8B9D7A9281F16BE30524964D2E422E405CC23F06389EDA78E5FC5EA1170957603DBFA0E5E91D08DCE2464C' (with hidden window)