tmp’ file is then copied to a filename of ‘Applet.cpl’, which is placed in the previously identified file path. The malware proceeds to identify the file path of either the common startup folder, or the user’s startup folder depending on if the SeDebugPrivilege privilege was obtained. In the event this privilege was obtained, the common startup folder is queried by reading the following registry key