Technical Information
- %TEMP%\1563.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1563.tmp' --ping<Full path to file> C1CF0A6602091DF41541CBC68DC8687A5850CB1601DB74D28C2B874FA86F48C5D00F4F192FF6569F3E185474CF0D6ACD99E49CB90AE8744981142ADC2E2CBDEE
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\1563.tmp' --ping<Full path to file> C1CF0A6602091DF41541CBC68DC8687A5850CB1601DB74D28C2B874FA86F48C5D00F4F192FF6569F3E185474CF0D6ACD99E49CB90AE8744981142ADC2E2CBDEE' (with hidden window)