Technical Information
- %TEMP%\958a.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\958a.tmp' --ping<Full path to file> CDAC8F0BE1F47ADF37BBACA410148CDEB757B8F45A0E4FB94D6B5EB42CE6C48CF56736F098978D7D91B5118DCF1641735466EB284482C0458539572416F97C9F
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\958a.tmp' --ping<Full path to file> CDAC8F0BE1F47ADF37BBACA410148CDEB757B8F45A0E4FB94D6B5EB42CE6C48CF56736F098978D7D91B5118DCF1641735466EB284482C0458539572416F97C9F' (with hidden window)