Technical Information
- %TEMP%\f78f.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\f78f.tmp' --ping<Full path to file> 7A6771D71ACF5BE34BB06771F155A41A60C305C69EA8CB5B06F3B4FFD860CC8B96DBC563EDE43FF78BA2698E4EC723579BD3154CB386959FDD8EE042CC6B0C97
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\f78f.tmp' --ping<Full path to file> 7A6771D71ACF5BE34BB06771F155A41A60C305C69EA8CB5B06F3B4FFD860CC8B96DBC563EDE43FF78BA2698E4EC723579BD3154CB386959FDD8EE042CC6B0C97' (with hidden window)