Technical Information
- %TEMP%\5f6d.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\5f6d.tmp' --ping<Full path to file> CE82DF4CAE55CF23BBC11AACCD478E594BAD9CE903080915AFB876B34260ACC3840EEDC403F5FF49D22CCFB7B150472E4AD9626BF456622956FD422E64696642
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\5f6d.tmp' --ping<Full path to file> CE82DF4CAE55CF23BBC11AACCD478E594BAD9CE903080915AFB876B34260ACC3840EEDC403F5FF49D22CCFB7B150472E4AD9626BF456622956FD422E64696642' (with hidden window)