To run persistently on the system, the Trojan will first create a VBScript file:SpecialFolder.CommonApplicationData\srvResesponded.vbs that contains:CreateObject(“WScript.Shell”).Run(“%app%”) The Trojan replaces the %app% string in the above VBScript with the path to its executable