Creates the following files
- %LOCALAPPDATA%\pq7p\winbrand.dll
- %LOCALAPPDATA%\pq7p\spinstall.exe
- %APPDATA%\macromedia\flash player\macromedia.com\sfqza0\winbrand.dll
- %APPDATA%\macromedia\flash player\macromedia.com\sfqza0\spinstall.exe
- %LOCALAPPDATA%\zxcka\fvewiz.dll
- %LOCALAPPDATA%\zxcka\bitlockerwizardelev.exe
- %APPDATA%\adobe\acrobat\dc\jscache\2owyaxmr\fvewiz.dll
- %APPDATA%\adobe\acrobat\dc\jscache\2owyaxmr\bitlockerwizardelev.exe
- %LOCALAPPDATA%\j9iixmi\mfc42u.dll
- %LOCALAPPDATA%\j9iixmi\mspaint.exe
- %APPDATA%\telegram desktop\6qz90fbtgla\mfc42u.dll
- %APPDATA%\telegram desktop\6qz90fbtgla\mspaint.exe
Deletes the following files
- %LOCALAPPDATA%\pq7p\spinstall.exe
- %LOCALAPPDATA%\pq7p\winbrand.dll
- %LOCALAPPDATA%\zxcka\bitlockerwizardelev.exe
- %LOCALAPPDATA%\zxcka\fvewiz.dll
- %LOCALAPPDATA%\j9iixmi\mfc42u.dll
- %LOCALAPPDATA%\j9iixmi\mspaint.exe
Substitutes the following files
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee