Technical Information
- %TEMP%\a062.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- DNS ASK ne###.##ficeapps.live.com
- '%TEMP%\a062.tmp' --ping<Full path to file> E0ACE57BFDF6F642352DA4ACC627D971B2809423FD47202FFD0C026FE42217808512A526ED564BB8E174B1B967C301271DEC5A51CA0319350A3198E421D4FE7D
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\a062.tmp' --ping<Full path to file> E0ACE57BFDF6F642352DA4ACC627D971B2809423FD47202FFD0C026FE42217808512A526ED564BB8E174B1B967C301271DEC5A51CA0319350A3198E421D4FE7D' (with hidden window)