Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OfficeSafe' = '<SYSTEM32>\taskmgr.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'hanni_umami_chapter' = '<Drive name for removable media>:\hanni_umami_chapter.exe'
- <Drive name for removable media>:\hanni_umami_chapter.exe