Technical Information
- %TEMP%\d539.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\d539.tmp' --ping<Full path to file> CFED0C49C02A0C77C4317AE61AB98FBE3C498DE37F3C2B40E394963283B68D375EDD5FC3A55F3847F14E10F57FFF10B32081F331363844E68FC4360054F94BAB
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\d539.tmp' --ping<Full path to file> CFED0C49C02A0C77C4317AE61AB98FBE3C498DE37F3C2B40E394963283B68D375EDD5FC3A55F3847F14E10F57FFF10B32081F331363844E68FC4360054F94BAB' (with hidden window)