Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\winnetsvc_ji3i68g3g.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %TEMP%\fss4gnl4.ord
Deletes following files that it created itself
- %TEMP%\fss4gnl4.ord
Network activity
TCP
Other
- 'al#####pdate.pages.dev':443
UDP
- DNS ASK al#####pdate.pages.dev
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\winnetsvc_ji3i68g3g.exe'
Executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\winnetsvc_ji3i68g3g.exe' ' (with hidden window)
