Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OfficeSafe' = '<SYSTEM32>\taskmgr.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'applicantform_en' = '<Drive name for removable media>:\applicantform_en.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'february_catalogue__2015' = '<Drive name for removable media>:\february_catalogue__2015.exe'
- <Drive name for removable media>:\applicantform_en.exe
- <Drive name for removable media>:\february_catalogue__2015.exe