Technical Information
- %TEMP%\c37d.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '34.##9.100.209':443
- '%TEMP%\c37d.tmp' --ping<Full path to file> 7329697F24952592E9379FDB8AE3A0A070F98800CD71B1BF6E96C0E30B4DDBC0E90724811EE493AAC59F8270E201D57A3F0D6BC51733BFC7DBC64F45EF8039E2
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\c37d.tmp' --ping<Full path to file> 7329697F24952592E9379FDB8AE3A0A070F98800CD71B1BF6E96C0E30B4DDBC0E90724811EE493AAC59F8270E201D57A3F0D6BC51733BFC7DBC64F45EF8039E2' (with hidden window)