Technical Information
- %TEMP%\5796.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\5796.tmp' --ping<Full path to file> E385660DDC9FB465003AFB4D9C709BE490914812D853E7B093ADF168DE0B411883F340C94E5F29FBA53505288B001553ACDBE588E8FDF5AD067B600C88A4ADAA
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\5796.tmp' --ping<Full path to file> E385660DDC9FB465003AFB4D9C709BE490914812D853E7B093ADF168DE0B411883F340C94E5F29FBA53505288B001553ACDBE588E8FDF5AD067B600C88A4ADAA' (with hidden window)