Technical Information
- %TEMP%\8b9c.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\8b9c.tmp' --ping<Full path to file> 4536D501AC6D53892064D5A71876BB66B846BB386922AD932E3AFB71C7B134EC43254C9CC3D23642E2663EBA68553AA878A09104BACAA07B25BB85AF1F50F171
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\8b9c.tmp' --ping<Full path to file> 4536D501AC6D53892064D5A71876BB66B846BB386922AD932E3AFB71C7B134EC43254C9CC3D23642E2663EBA68553AA878A09104BACAA07B25BB85AF1F50F171' (with hidden window)