Creates the following files
- %LOCALAPPDATA%\mqodp\wer.dll
- %LOCALAPPDATA%\mqodp\wermgr.exe
- %APPDATA%\icqm\icq\html\uz\error\ab5obmvzi\wer.dll
- %APPDATA%\icqm\icq\html\uz\error\ab5obmvzi\wermgr.exe
- %LOCALAPPDATA%\vgl\version.dll
- %LOCALAPPDATA%\vgl\mpsigstub.exe
- %APPDATA%\microsoft\crypto\jqh\version.dll
- %APPDATA%\microsoft\crypto\jqh\mpsigstub.exe
- %LOCALAPPDATA%\50nrt\sqmapi.dll
- %LOCALAPPDATA%\50nrt\spreview.exe
- %APPDATA%\microsoft\systemcertificates\my\crls\dnx26fdhhz\sqmapi.dll
- %APPDATA%\microsoft\systemcertificates\my\crls\dnx26fdhhz\spreview.exe
Deletes the following files
- %LOCALAPPDATA%\mqodp\wer.dll
- %LOCALAPPDATA%\mqodp\wermgr.exe
- %LOCALAPPDATA%\vgl\mpsigstub.exe
- %LOCALAPPDATA%\vgl\version.dll
- %LOCALAPPDATA%\50nrt\spreview.exe
- %LOCALAPPDATA%\50nrt\sqmapi.dll
Modifies the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Substitutes the following files
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee