Upon execution, It checks for the file "network.log" in the c:\ drive, and then writes "Log file Open" to this file. It then writes in this log file random addresses with the text:
" Subnet : ...0"
Random number 1 is the number between 199 to 214
Random number 2 and Random number 3 is the number between1 to 254

Then it picks a random address for it to scan. Then it checks for a computer in a network wherein the shared format of c:\ is full control. It then maps the c:\ of the computer as j:\.

It then adds the following line to the log file, network.log, for every drive it has mapped:
"Copying files to :" and checks the first network.vbs file it copies and then writes to the log:
"Successful copy to : ".

After mapping c:\ to j:\, it copies:
"c:\network.vbs" à
"j:\windows\startm~1\programs\startup\"
"c:\windows\dnetc.ini" à "j:\windows\"
"c:\windows\dnetc.exe" à "j:\windows\"
"c:\windows\startm~1\programs\startup\microsoft_office.lnk"
à j:\windows\startm~1\programs\startup\

When the infected computer reboots, the Trojan is run, it is in the startup directory. With this the hacker can access all the files in c:\.

This form of lookup can also act as a Distributed Denial of Service (DDOS) attack since the queries the Trojan performs can overwhelm a server until all requests cannot be serviced anymore, thereby crashing the system.