Technical Information
- %TEMP%\f40e.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\f40e.tmp' --ping<Full path to file> 0B0D5EB4DD7E07DC7848F1319D62608BF6144555C84CB4254AE9A9C6CEDD371D65C34B06DEC9AF51CBC2A1C43E23727F87F54624E1C63518883F2754F356FC5B
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\f40e.tmp' --ping<Full path to file> 0B0D5EB4DD7E07DC7848F1319D62608BF6144555C84CB4254AE9A9C6CEDD371D65C34B06DEC9AF51CBC2A1C43E23727F87F54624E1C63518883F2754F356FC5B' (with hidden window)