Technical Information
- %TEMP%\d30b.tmp
- from <Full path to file> to <PATH_SAMPLE>.docx
- DNS ASK ne###.##ficeapps.live.com
- '%TEMP%\d30b.tmp' --ping<Full path to file> C4E88AA6EE57FE3E980854DB723B3B8376FE5C2242B852628681612E67C70E977C560EB3F7FDF98CBD4353EF606262CD8B6E467D83937572E01FC9FAB0C89566
- '%ProgramFiles(x86)%\microsoft office\office16\winword.exe' /n "<PATH_SAMPLE>.docx" /o ""
- '%TEMP%\d30b.tmp' --ping<Full path to file> C4E88AA6EE57FE3E980854DB723B3B8376FE5C2242B852628681612E67C70E977C560EB3F7FDF98CBD4353EF606262CD8B6E467D83937572E01FC9FAB0C89566' (with hidden window)