Technical Information
- %TEMP%\4ba0.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '15#.#01.129.91':443
- '%TEMP%\4ba0.tmp' --ping<Full path to file> A4F34A900029D775811B3B355B4197D04E893F909E3F7A9C3FB6517AF545861C5683DD5C03944670DD4CE89B776795EE7BB6D83375CCD90ABCABE354F5446816
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\4ba0.tmp' --ping<Full path to file> A4F34A900029D775811B3B355B4197D04E893F909E3F7A9C3FB6517AF545861C5683DD5C03944670DD4CE89B776795EE7BB6D83375CCD90ABCABE354F5446816' (with hidden window)