Technical Information
- '<SYSTEM32>\notepad.exe' %APPDATA%\doubt_not_you.txt
- '<SYSTEM32>\wbem\wmic.exe'
- %APPDATA%\doubt_not_you.txt
- from %APPDATA%\doubt_not_you.txt to %APPDATA%\doubt_not_you.xsl
- ClassName: 'notepad' WindowName: ''
- ClassName: 'edit' WindowName: ''
- ClassName: 'consolewindowclass' WindowName: ''
- '<SYSTEM32>\notepad.exe' %APPDATA%\doubt_not_you.txt' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' ' (with hidden window)