Technical Information
- %TEMP%\fd9a.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\fd9a.tmp' --ping<Full path to file> 4D705949249E8359F49435001D34F5F73388790DA24467A8CC623F6B2D7D976EC23755737EB636270FE11490672319692B943994238E7CC30DAC5E03FEEB0178
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\fd9a.tmp' --ping<Full path to file> 4D705949249E8359F49435001D34F5F73388790DA24467A8CC623F6B2D7D976EC23755737EB636270FE11490672319692B943994238E7CC30DAC5E03FEEB0178' (with hidden window)