Creates the following files
- %TEMP%\temp\hunlat.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\r7a03024
- %HOMEPATH%\files.zip
- %HOMEPATH%\files\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\files\lisp_success.doc
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %HOMEPATH%\files\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\files\fi51.doc
- %HOMEPATH%\files\february_catalogue__2015.doc
- %HOMEPATH%\files\cveuropeo.doc
- %HOMEPATH%\files\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\explorer.exe
- %HOMEPATH%\recommended.4nn
- %TEMP%\92edfa73be22471abf45c03d92883321.xml
- %HOMEPATH%\files\file_p_00000000_1371597592.docx
- %HOMEPATH%\credentials.txt
Deletes the following files
- %HOMEPATH%\files.zip~rf11186f.tmp
Moves the following files
- from %HOMEPATH%\files.zip to %HOMEPATH%\files.zip~rf11186f.tmp
Substitutes the following files