Technical Information
- %TEMP%\3fc4.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\3fc4.tmp' --ping<Full path to file> FFBB73344EB54AD9350CEAF84760BF85A148EB939D598821857F30639FA606A15790991CE1A7AACD54ABB6B6E31D467AC0B54378E77148BF1D15918AD6024378
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\3fc4.tmp' --ping<Full path to file> FFBB73344EB54AD9350CEAF84760BF85A148EB939D598821857F30639FA606A15790991CE1A7AACD54ABB6B6E31D467AC0B54378E77148BF1D15918AD6024378' (with hidden window)