Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net.exe' stop "windows installer"
Modifies file system:
Creates the following files:
- %TEMP%\GLC1.tmp
- %TEMP%\GLG3.tmp
- C:\Software_Distribution\logs\~GLH0000.TMP
Moves the following files:
- from C:\Software_Distribution\logs\~GLH0000.TMP to C:\Software_Distribution\logs\UNWISE.EXE
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c net stop "windows installer"
- '<SYSTEM32>\net1.exe' stop "windows installer"
