Technical Information
- %TEMP%\1850.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\1850.tmp' --ping<Full path to file> 98B8BC16F47CF15D51776E70B1C21676B6F49CD264650B4E36F79FC30C17CB0811F95896F70D1EDF2F8AC1A790D07F218846E42E93FF7A6C488ADEABF14F4F30
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\1850.tmp' --ping<Full path to file> 98B8BC16F47CF15D51776E70B1C21676B6F49CD264650B4E36F79FC30C17CB0811F95896F70D1EDF2F8AC1A790D07F218846E42E93FF7A6C488ADEABF14F4F30' (with hidden window)