Technical Information
- %TEMP%\d5ba.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\d5ba.tmp' --ping<Full path to file> 2FD239A4D1736ECC7279D2916FB7C85CD5AC37FE171A31DE3B5E059535C6CDA35DE3BDBC9FFFFB10B4EF95F02A90246A04FF409FDFDB42E7C0C48A86120C8780
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\d5ba.tmp' --ping<Full path to file> 2FD239A4D1736ECC7279D2916FB7C85CD5AC37FE171A31DE3B5E059535C6CDA35DE3BDBC9FFFFB10B4EF95F02A90246A04FF409FDFDB42E7C0C48A86120C8780' (with hidden window)