Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OfficeSafe' = '<SYSTEM32>\taskmgr.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '508softwareandos' = '<Drive name for removable media>:\508softwareandos.exe'
- <Drive name for removable media>:\508softwareandos.exe