Technical Information
- %TEMP%\ff64.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\ff64.tmp' --ping<Full path to file> BFE1809B5D49B58D07EAA08F6DE68A4965977FAA4DBA813BD851F69BE51AAD45330FCF2E37334CC0BDCDDC1B28CBC99DBA263DAC09960E23E7AB84752E5171CB
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\ff64.tmp' --ping<Full path to file> BFE1809B5D49B58D07EAA08F6DE68A4965977FAA4DBA813BD851F69BE51AAD45330FCF2E37334CC0BDCDDC1B28CBC99DBA263DAC09960E23E7AB84752E5171CB' (with hidden window)