Technical Information
Modifies file system
Creates the following files
- %TEMP%\iw6x-icon.png
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <Full path to file>.old
Deletes itself.
Network activity
Connects to
- 'ci.##pveyor.com':443
- 'microsoft.com':80
- 'ap#########ata.blob.core.windows.net':443
- 'oc##.#tartssl.com':80
TCP
- 'ci.##pveyor.com':443
- 'ap#########ata.blob.core.windows.net':443
UDP
- DNS ASK ci.##pveyor.com
- DNS ASK microsoft.com
- DNS ASK ap#########ata.blob.core.windows.net
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
