It installs three primary files to the target system which are a legitimate copy of Winword (Microsoft Word), a maliciously crafted wwlib.dll file, and a file with a random name and extension.