Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Firewall' = '"<SYSTEM32>\csrss.exe"'
- hidden files
- %WINDIR%\syswow64\csrss.exe
- %CommonProgramFiles(x86)%\svchost.exe
- %WINDIR%\syswow64\csrss.exe
- %CommonProgramFiles(x86)%\svchost.exe
- 'ls#####a.bplaced.net':80
- http://ls#####a.bplaced.net/BiLDeR/gate.php
- DNS ASK ls#####a.bplaced.net
- '%WINDIR%\syswow64\csrss.exe'
- '%CommonProgramFiles(x86)%\svchost.exe'
- '%WINDIR%\syswow64\csrss.exe' ' (with hidden window)
- '%CommonProgramFiles(x86)%\svchost.exe' ' (with hidden window)