Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Client Server Runtime Process' = '%APPDATA%\cssrs.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Logon Application' = '%PROGRAMDATA%\winlogin.exe'
- %APPDATA%\cssrs.exe
- %PROGRAMDATA%\winlogin.exe
- %APPDATA%\cssrs.exe
- %PROGRAMDATA%\winlogin.exe
- '%APPDATA%\cssrs.exe'