Technical Information
- %TEMP%\8890.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\8890.tmp' --ping<Full path to file> D02779ED859690C58524D9DF3FB367277C2376904AC2A4A8F3C5B2CC8871DF3D65173A63ECA0D1D0839E3E8E2A0B3FC5292052B1F9456C7B8A4114BE03391A84
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\8890.tmp' --ping<Full path to file> D02779ED859690C58524D9DF3FB367277C2376904AC2A4A8F3C5B2CC8871DF3D65173A63ECA0D1D0839E3E8E2A0B3FC5292052B1F9456C7B8A4114BE03391A84' (with hidden window)