Technical Information
- %TEMP%\895b.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\895b.tmp' --ping<Full path to file> E128543D8A701AF166848B79C03ECECDD7DEC35E291F40C9DD0F8B5D1B760DDAD470974A77EFD56A6E6A4376AAC90700D661753607F5CDD6B93F345A0FD3A6E2
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\895b.tmp' --ping<Full path to file> E128543D8A701AF166848B79C03ECECDD7DEC35E291F40C9DD0F8B5D1B760DDAD470974A77EFD56A6E6A4376AAC90700D661753607F5CDD6B93F345A0FD3A6E2' (with hidden window)