Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OfficeSafe' = '<SYSTEM32>\taskmgr.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'weeklysheet1215' = '<Drive name for removable media>:\weeklysheet1215.exe'
- <Drive name for removable media>:\weeklysheet1215.exe