Once the payload is successfully executed, it will proceed to copy files to the following locations:  C:\ProgramData\ManagerApp\AdapterTroubleshooter.exe C:\ProgramData\ManagerApp\15b937.cab C:\ProgramData\ManagerApp\install.cab C:\ProgramData\ManagerApp\msvcr90.dll C:\ProgramData\ManagerApp\d3d9.dll  The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique.  The “d3d9.dll” file is malicious and is loaded into memory by the legit binary upon execution.  Once loaded, the DLL will then inject FinSpy into the Winlogon process