Technical Information
- %TEMP%\9120.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- DNS ASK ne###.##ficeapps.live.com
- '%TEMP%\9120.tmp' --ping<Full path to file> EC2558F1C0FA0D44EC905E62D9725365A58CD85EB873A8F40C271C6D5F3A85066315BD7CD2FD889DB7112FB31F87383BFAA1768FA1F8AE5170401CAB04F42B79
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\9120.tmp' --ping<Full path to file> EC2558F1C0FA0D44EC905E62D9725365A58CD85EB873A8F40C271C6D5F3A85066315BD7CD2FD889DB7112FB31F87383BFAA1768FA1F8AE5170401CAB04F42B79' (with hidden window)