Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AbdElR-AhmAn_MosTaFa' = '"<SYSTEM32>\System.exe"'
- <SYSTEM32>\System.exe
- C:\The_Man.reg
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- '%WINDIR%\regedit.exe' /s "The_Man.reg"