Technical Information
- %TEMP%\83de.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\83de.tmp' --ping<Full path to file> 314C1F606531AD8433ED47C817CB53A9D9034186623CA8A3DE2AF981D50ABA0576BD7498AECC7228752685DDF2E18E390BCD0B1AE8C40C247295AE6D4A2F2B1A
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\83de.tmp' --ping<Full path to file> 314C1F606531AD8433ED47C817CB53A9D9034186623CA8A3DE2AF981D50ABA0576BD7498AECC7228752685DDF2E18E390BCD0B1AE8C40C247295AE6D4A2F2B1A' (with hidden window)