Technical Information
- %TEMP%\4552.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- DNS ASK ne###.##ficeapps.live.com
- '%TEMP%\4552.tmp' --ping<Full path to file> 25F4534A7C17E09D17154637B5AE8DFF7F7154E77661D26A1AF785BF08648FF6AF5892B8EBC053E925214FDD6D04F1C4052B4C5DA11D213E289AE49CC2FE7F15
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\4552.tmp' --ping<Full path to file> 25F4534A7C17E09D17154637B5AE8DFF7F7154E77661D26A1AF785BF08648FF6AF5892B8EBC053E925214FDD6D04F1C4052B4C5DA11D213E289AE49CC2FE7F15' (with hidden window)
