Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'svchost.exe' = '%WINDIR%\svchost.exe'
- %WINDIR%\svchost.exe
- <Current directory>\half-life_hack_v23..exe
- '%WINDIR%\svchost.exe'
- '<Current directory>\half-life_hack_v23..exe'
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\ping.exe' -n 2 127.0.0.1