Technical Information
- %TEMP%\ef3e.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- '%TEMP%\ef3e.tmp' --ping<Full path to file> 4FB37CCB9CA44B644B1ADB42FC70C143D4FA870EB774AF9A9E24D6FF2FA740D192EDDC07D46494D8DCCCF51A65DB9488B84A23889F236ED3C9FC69E1135ED6FD
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\ef3e.tmp' --ping<Full path to file> 4FB37CCB9CA44B644B1ADB42FC70C143D4FA870EB774AF9A9E24D6FF2FA740D192EDDC07D46494D8DCCCF51A65DB9488B84A23889F236ED3C9FC69E1135ED6FD' (with hidden window)