Technical Information
- %TEMP%\c2ba.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\c2ba.tmp' --ping<Full path to file> 421A37CF8A82F4C2E9874D358DE8B987BDD4FE42AC0D5DA34C6F69B40D73B8AA96DF2F684872B63B0EF8D8824F5E46D8E4DA6D4027B9F2D1E4958199065EC268
- '%TEMP%\c2ba.tmp' --ping<Full path to file> 421A37CF8A82F4C2E9874D358DE8B987BDD4FE42AC0D5DA34C6F69B40D73B8AA96DF2F684872B63B0EF8D8824F5E46D8E4DA6D4027B9F2D1E4958199065EC268' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"