Technical Information
- <SYSTEM32>\tasks\tour mfsoft
- %APPDATA%\microsoft\windows\start menu\programs\startup\yourapp.lnk
- '<SYSTEM32>\taskeng.exe' {7F0902BD-509F-4B0D-89E3-C287597B8408} S-1-5-21-3691498038-2086406363-2140527554-1000:jnnrducbawu\user:Interactive:[1]