Technical Information
- %TEMP%\8c86.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\8c86.tmp' --ping<Full path to file> 89B64F3A67AC1A18C0D18B0C89A2CA119B38B5E825684669AA1EAFA689185BA86C7F4571AC03062E1F0EF22C392679A206450BCD31FD39E3183C39A58FBAFAA5
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\8c86.tmp' --ping<Full path to file> 89B64F3A67AC1A18C0D18B0C89A2CA119B38B5E825684669AA1EAFA689185BA86C7F4571AC03062E1F0EF22C392679A206450BCD31FD39E3183C39A58FBAFAA5' (with hidden window)