Technical Information
- %TEMP%\2fa7.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\2fa7.tmp' --ping<Full path to file> 6C8F4A8AFBE3B1F3088CD2312F7BA6AAF693FFE779F3B6D83DE4B3D8F687C9BFF2F4FE986225C58C0C08AB0D7218841451CA7A61C3DC3B2AE0E0446583E12537
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"
- '%TEMP%\2fa7.tmp' --ping<Full path to file> 6C8F4A8AFBE3B1F3088CD2312F7BA6AAF693FFE779F3B6D83DE4B3D8F687C9BFF2F4FE986225C58C0C08AB0D7218841451CA7A61C3DC3B2AE0E0446583E12537' (with hidden window)