Technical Information
- %TEMP%\9a99.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\9a99.tmp' --ping<Full path to file> 0EAD776438D1A079B0EAE97215861352D56D10F27CFFDD2237755053F9DEE638E219140EFEF8057DD4112B7F0AE630147FA700CD006BDC47FF20A8F029A96810
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\9a99.tmp' --ping<Full path to file> 0EAD776438D1A079B0EAE97215861352D56D10F27CFFDD2237755053F9DEE638E219140EFEF8057DD4112B7F0AE630147FA700CD006BDC47FF20A8F029A96810' (with hidden window)