Technical Information
- %TEMP%\8fa9.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\8fa9.tmp' --ping<Full path to file> 8521A66F37092EE81F76CD0AC743FD609A26B0E05780A07FCDB852CC6E02CF3F74448F5B87A9FF11F6CF5934BE3D5F1F39DF2BA0BF28FF208BE8515D68C66068
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\8fa9.tmp' --ping<Full path to file> 8521A66F37092EE81F76CD0AC743FD609A26B0E05780A07FCDB852CC6E02CF3F74448F5B87A9FF11F6CF5934BE3D5F1F39DF2BA0BF28FF208BE8515D68C66068' (with hidden window)