If the mutex does not exist and a Windows Startup Registry key with name “System Update” does not exist, the malware performs its initialization routine by:  Copying itself to the path %PROGRAMDATA%\svchost.exe Sets the Windows Startup Registry key with the name “System Update” which points to the above dropped payload