Technical Information
- %TEMP%\d5af.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\d5af.tmp' --ping<Full path to file> 7EE2417BD8613486B5E22C914F537144920B44F06BC3C9733B02F9C7398FDF3A7B30B0A9C86AA82585B0A2F0DF2930A5B0166445DBD311EEA38DBB9E5B249531
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\d5af.tmp' --ping<Full path to file> 7EE2417BD8613486B5E22C914F537144920B44F06BC3C9733B02F9C7398FDF3A7B30B0A9C86AA82585B0A2F0DF2930A5B0166445DBD311EEA38DBB9E5B249531' (with hidden window)