Technical Information
- %TEMP%\ef3e.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\ef3e.tmp' --ping<Full path to file> 0FFDA14DBFD237C5C79E89324124D19DC25A156F7B9A32B28C84D02370C3BD633A348E528BB6BFCD71D34E7DD1B8E45D7031E49DF19A978E6892DFC8D0CADAC7
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\ef3e.tmp' --ping<Full path to file> 0FFDA14DBFD237C5C79E89324124D19DC25A156F7B9A32B28C84D02370C3BD633A348E528BB6BFCD71D34E7DD1B8E45D7031E49DF19A978E6892DFC8D0CADAC7' (with hidden window)