The backdoor installer will drop a normal sidebar.exe file (a Windows Gadget tool, a feature already discontinued by Windows), a malicious loader (in "C:\ProgramData\Apple\Update\wab32res.dll"), and an encrypted configuration file