Technical Information
- %TEMP%\413b.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\413b.tmp' --ping<Full path to file> 630B679DEF9D95B0B5DCEEC9434323ACBFDEC45E475ADB1E74A98B33E18232AE17ABE4CC873CA009442670008E238B5DE631AFD0A72E8E535523CB4317BFE20D
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\413b.tmp' --ping<Full path to file> 630B679DEF9D95B0B5DCEEC9434323ACBFDEC45E475ADB1E74A98B33E18232AE17ABE4CC873CA009442670008E238B5DE631AFD0A72E8E535523CB4317BFE20D' (with hidden window)