Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%APPDATA%\winlogon32.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{77UD421E-3YN3-74GY-CFP0-4S4X65U12263}] 'StubPath' = '%APPDATA%\winlogon32.exe'
- %APPDATA%\winlogon32.exe
- '92.##1.190.18':6667
- '%APPDATA%\winlogon32.exe'