Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\officecleaner.bat
- '<SYSTEM32>\print.exe' /D:"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\officecleaner.bat" "%TEMP%\_TMP12"
- '<SYSTEM32>\print.exe' /D:"%TEMP%\officecleaner.dll" "%TEMP%\_TMP13"
- %TEMP%\~wrd0000.tmp
- %TEMP%\_tmp14.rtf
- %TEMP%\~wrd0001.tmp
- %TEMP%\<File name>.doc
- %TEMP%\_tmp12
- %TEMP%\_tmp13
- %TEMP%\officecleaner.dll
- %TEMP%\_tmp12
- %TEMP%\_tmp13
- %TEMP%\_tmp14.rtf
- from %TEMP%\~wrd0000.tmp to %TEMP%\_tmp14.rtf
- from %TEMP%\~wrd0001.tmp to %TEMP%\<File name>.doc
- '<SYSTEM32>\print.exe' /D:"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\officecleaner.bat" "%TEMP%\_TMP12"' (with hidden window)
- '<SYSTEM32>\print.exe' /D:"%TEMP%\officecleaner.dll" "%TEMP%\_TMP13"' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /Automation -Embedding