Created Files

• %Desktop%\spymarshal.lnk

Created Folders

• %StartMenu%\programs\spymarshal
• %ProgramFiles%\spymarshal

Registry Entries

• Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
• Value: windows update loader
• Data:
• Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
• Value: SpyMarshal
• Data:
• Key: HKEY_CURRENT_USER\software\spymarshal
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spymarshal
• Value:
• Data: