Technical Information
- hidden files
- %APPDATA%\System86\csrss.exe
- %APPDATA%\System86\csrss.exe
- %APPDATA%\System86\csrss.exe
- 'ip###odb.com':80
- 'wp#d':80
- ip###odb.com/ip_query_country.php
- wp#d/wpad.dat
- DNS ASK ip###odb.com
- DNS ASK wp#d
- '<Private IP address>':1039
- '<Private IP address>':1036