Technical Information
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'SysRun' = '{D7FFD784-5276-42D1-887B-00267870A4C7}'
- %WINDIR%\syswow64\wininet.exe
- %WINDIR%\syswow64\svshost.dll
- %WINDIR%\syswow64\winint.exe
- '%WINDIR%\syswow64\wininet.exe'