Technical Information
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] ' ' = '<SYSTEM32>\cmd.exe /C del /Q "<Full path to file>" "<SYSTEM32>\tcpdp.sys" "<SYSTEM32>\oleup32.dll" "<SYSTEM32>\mntsys...