Technical Information
- %TEMP%\989.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\989.tmp' --ping<Full path to file> A8FAABAE37CB3697DBD11F2D61ED8AAE77EEE4F82E0A6EC1DF09F93AB8E86CBF0B9A3F296C8E2CC64B2CFACBB1B66C059525F1BF837E0F55E816711022B6C406
- '%TEMP%\989.tmp' --ping<Full path to file> A8FAABAE37CB3697DBD11F2D61ED8AAE77EEE4F82E0A6EC1DF09F93AB8E86CBF0B9A3F296C8E2CC64B2CFACBB1B66C059525F1BF837E0F55E816711022B6C406' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"