Technical Information
- %TEMP%\5c52.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\5c52.tmp' --ping<Full path to file> 293FF7CC347BD36AA83C26257D40177E01F16FD6B4DBED826F4C64A184051A4C1D1B1A9FB2A9F21DA7327B699A9B52C85A2CFB51365331BFFBA30E1D1531974B
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\5c52.tmp' --ping<Full path to file> 293FF7CC347BD36AA83C26257D40177E01F16FD6B4DBED826F4C64A184051A4C1D1B1A9FB2A9F21DA7327B699A9B52C85A2CFB51365331BFFBA30E1D1531974B' (with hidden window)