Technical Information
- %TEMP%\3982.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- '%TEMP%\3982.tmp' --ping<Full path to file> 791B24D368807134FB5D706A41793ACD96734B948EAD8853E60754391658254EF7097743CA971760F5FC0829D9885D5FF3181C912CF866B522FC18A7737966D1
- '%TEMP%\3982.tmp' --ping<Full path to file> 791B24D368807134FB5D706A41793ACD96734B948EAD8853E60754391658254EF7097743CA971760F5FC0829D9885D5FF3181C912CF866B522FC18A7737966D1' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.docx"