Technical Information
- %TEMP%\468a.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\468a.tmp' --ping<Full path to file> 5420EB6040C83190AC02273EEE93E93B93A4FF0EB0844C67D0251BC65CE0B05AF5ACC097092FC61447C0FC42D4BCA9A4B3EDB6B4AA6D6BC3F1789285B1133A92
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\468a.tmp' --ping<Full path to file> 5420EB6040C83190AC02273EEE93E93B93A4FF0EB0844C67D0251BC65CE0B05AF5ACC097092FC61447C0FC42D4BCA9A4B3EDB6B4AA6D6BC3F1789285B1133A92' (with hidden window)