Windows Library-ms Persistence

The Trojan DLL file is written into the Documents.library-ms configuration file and Junction Folders are created. It takes effect when the user logs in or browses the desktop.

Note

This method is not anti-detection.

Operation Method

Refer to Winlogon Helper DLL Persistence