Technical Information
- 'C:\csrss.exe'
- 'C:\csrss.exe' (downloaded from the Internet)
- '<SYSTEM32>\cmd.exe' /c start c:\csrss.exe
- '<SYSTEM32>\attrib.exe' +r +s +h C:\csrss.exe
- '<SYSTEM32>\cmd.exe' /c attrib +r +s +h C:\csrss.exe
- C:\csrss.exe
- C:\csrss.exe
- 'fr####fhosting.com':80
- http://fr####fhosting.com/e39c7b62f5.pdf
- DNS ASK fr####fhosting.com