The two dropped artifacts – a payload DLL and a Word document – are written to the “Users\&lt;Log on User&gt;\” folder (the document will replace the opened malicious document with clean stub after killing the running Word process