Technical Information
- %TEMP%\6899.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\6899.tmp' --ping<Full path to file> FBC574C827D082E67257250110FC767DC7B1EFB34B533A6A4B425AC1DAC8F09B62F5515B209CA75995DE2B3C159223C7E8C6461EF868F1F0EBD3A716C1303DD3
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\6899.tmp' --ping<Full path to file> FBC574C827D082E67257250110FC767DC7B1EFB34B533A6A4B425AC1DAC8F09B62F5515B209CA75995DE2B3C159223C7E8C6461EF868F1F0EBD3A716C1303DD3' (with hidden window)