Technical Information
- %TEMP%\bb48.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- DNS ASK ne###.##ficeapps.live.com
- '%TEMP%\bb48.tmp' --ping<Full path to file> FA384A12AF8FB14918B49615F370483E0048F78B64E73986F7ABD6A33729BDC0B4BC27647C1793111F82A07D6E502FB081034E086252F5A6947458304AF3CBCC
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\bb48.tmp' --ping<Full path to file> FA384A12AF8FB14918B49615F370483E0048F78B64E73986F7ABD6A33729BDC0B4BC27647C1793111F82A07D6E502FB081034E086252F5A6947458304AF3CBCC' (with hidden window)