Technical Information
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
- <SYSTEM32>\tasks\firefox default browser agent 332344e6516ece46
- [HKLM\System\CurrentControlSet\Services\WBICreatorService 6.5] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WBICreatorService 6.5] 'ImagePath' = '%ALLUSERSPROFILE%\WBICreatorService 6.5\WBICreatorService 6.5.exe'
- 'WBICreatorService 6.5' %ALLUSERSPROFILE%\WBICreatorService 6.5\WBICreatorService 6.5.exe
- 676d.exe
- %APPDATA%\vrbtect
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
- %ALLUSERSPROFILE%\wbicreatorservice 6.5\wbicreatorservice 6.5.exe
- %TEMP%\4kpv6a~1\state.tmp
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %LOCALAPPDATA%\menu\menu.exe
- %LOCALAPPDATA%\menu\unins000.dat
- %LOCALAPPDATA%\menu\is-kc86d.tmp
- %LOCALAPPDATA%\menu\languages\is-c12mm.tmp
- %LOCALAPPDATA%\menu\is-ev706.tmp
- %LOCALAPPDATA%\menu\is-i79su.tmp
- %LOCALAPPDATA%\menu\is-3e2si.tmp
- %LOCALAPPDATA%\menu\is-iimm4.tmp
- %LOCALAPPDATA%\menu\is-3lo5g.tmp
- %LOCALAPPDATA%\menu\is-97vak.tmp
- %LOCALAPPDATA%\menu\is-0vsm9.tmp
- %LOCALAPPDATA%\menu\is-dftj2.tmp
- %LOCALAPPDATA%\menu\is-0r5df.tmp
- %LOCALAPPDATA%\menu\is-m732d.tmp
- %TEMP%\7f80.exe
- %TEMP%\676d.exe
- %TEMP%\4e32.exe
- %TEMP%\is-m4aer.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-m4aer.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-m4aer.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3cbp8.tmp\31db.tmp
- %TEMP%\31db.exe
- %TEMP%\29bf.dll
- %TEMP%\425.exe
- %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
- %TEMP%\4kpv6a~1\cached-microdescs.new
- %APPDATA%\vrbtect
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %LOCALAPPDATA%\menu\libgcc_s_dw2-1.dll
- %TEMP%\29bf.dll
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %TEMP%\4kpv6a~1\cached-certs
- %TEMP%\4kpv6a~1\state
- from %LOCALAPPDATA%\menu\is-m732d.tmp to %LOCALAPPDATA%\menu\unins000.exe
- from %LOCALAPPDATA%\menu\is-0r5df.tmp to %LOCALAPPDATA%\menu\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\menu\is-0vsm9.tmp to %LOCALAPPDATA%\menu\libogg-0.dll
- from %LOCALAPPDATA%\menu\is-97vak.tmp to %LOCALAPPDATA%\menu\libvorbis-0.dll
- from %LOCALAPPDATA%\menu\is-3lo5g.tmp to %LOCALAPPDATA%\menu\libwinpthread-1.dll
- from %LOCALAPPDATA%\menu\is-iimm4.tmp to %LOCALAPPDATA%\menu\libbz2-1.dll
- from %LOCALAPPDATA%\menu\is-3e2si.tmp to %LOCALAPPDATA%\menu\zlib1.dll
- from %LOCALAPPDATA%\menu\is-i79su.tmp to %LOCALAPPDATA%\menu\swresample-3.dll
- from %LOCALAPPDATA%\menu\is-ev706.tmp to %LOCALAPPDATA%\menu\setting.ini
- from %LOCALAPPDATA%\menu\languages\is-c12mm.tmp to %LOCALAPPDATA%\menu\languages\turkish.ini
- from %LOCALAPPDATA%\menu\is-kc86d.tmp to %LOCALAPPDATA%\menu\menu.exe
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
- from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
- from %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\cached-microdesc-consensus
- %LOCALAPPDATA%\menu\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\4kpv6a~1\cached-certs
- %TEMP%\4kpv6a~1\state
- 'se####ation17io.io':80
- 'as####-buyer.com':443
- 'as####fotech.com':443
- 'localhost':49322
- 'so###mviver.com':443
- 'be###niet.com':443
- 'bm###ybar.com':443
- 'as####olcano.com':443
- 'bb###neco.com':443
- 'sr###roduct.com':443
- 'ax####velops.com':443
- 'as####munity.com':443
- 'ar####ptions.com':443
- 'ar####-amade.com':443
- 'br#####servicesllc.com':443
- 'ap####vip-br.com':443
- 'ap####ru-seo.com':443
- 'at###noir.com':443
- 'ba####g-stay.com':443
- 'be###ours.com':443
- 'br###luxe.com':443
- 'va######nsportnature.com':443
- 'bo###upnj.com':443
- 'an####erdomo.com':443
- 'bu###dudu.com':443
- 'b2####lition.com':443
- 'bd###acus.com':443
- 'aw####alazel.com':443
- 'an####eorban.com':443
- 'as###humi.com':443
- 'be####amille.com':443
- 'ay####coffee.com':443
- 'be####bet-br.com':443
- 'ba####zuriel.com':443
- 'localhost':49377
- 'localhost':49375
- 'localhost':49373
- 'localhost':49371
- 'localhost':49369
- 'localhost':49367
- 'localhost':49365
- 'localhost':49363
- 'localhost':49361
- 'localhost':49359
- 'ba####magico.com':443
- 'localhost':49355
- 're###tcha.cloud':443
- 'ba###s184.com':443
- 'ba###s435.com':443
- 'au####ysk-pl.com':443
- 'localhost':49349
- 'as###ajit.com':443
- 'localhost':49346
- 'aq####ave-tr.com':443
- 'ba###aius.com':443
- 'ss###raders.com':443
- 'ar####eideas.com':443
- 'an####uplink.com':443
- 'ba####zerian.com':443
- 'ap####top-br.com':443
- 'al####dallas.com':443
- 'an####oradio.com':443
- 'localhost':49237
- 'localhost':49233
- 'localhost':49231
- 'localhost':49229
- 'localhost':49227
- 'localhost':49225
- 'localhost':49223
- 'localhost':49221
- 'localhost':49219
- 'localhost':49217
- 'localhost':49215
- 'localhost':49213
- 'localhost':49211
- 'localhost':49209
- 'localhost':49207
- 'localhost':49205
- 'localhost':49203
- 'localhost':49201
- 'localhost':49199
- 'localhost':20544
- '66.#06.0.82':9001
- '85.##0.227.103':443
- '19#.#45.61.196':443
- '13#.#62.210.252':443
- 'localhost':49189
- 'tr##c.com':80
- '18#.#72.128.19':80
- 'jo##.bestsup.su':80
- 'localhost':49235
- 'localhost':49239
- 'localhost':49297
- 'localhost':49241
- 'localhost':49295
- 'localhost':49293
- 'localhost':49291
- 'localhost':49289
- 'localhost':49287
- 'localhost':49283
- 'localhost':49284
- 'localhost':49281
- 'localhost':49279
- 'localhost':49277
- 'localhost':49275
- 'localhost':49273
- 'localhost':49271
- 'localhost':49269
- 'localhost':49267
- 'localhost':49265
- 'localhost':49263
- 'localhost':49261
- 'localhost':49259
- 'localhost':49257
- 'localhost':49255
- 'localhost':49253
- 'localhost':49251
- 'localhost':49249
- 'localhost':49247
- 'localhost':49245
- 'localhost':49243
- 'an####esifre.com':443
- 'localhost':49382
- http://jo##.bestsup.su/data/pdf/may.exe
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0776.exe
- http://tr##c.com/check/index.php
- http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/upd.php?n=#################################################################################################################...
- http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/task.php?n=################################################################################################################...
- http://se####ation17io.io/index.php
- '13#.#62.210.252':443
- 'localhost':49272
- 'localhost':49252
- 'at###noir.com':443
- 'be###ours.com':443
- 'br###luxe.com':443
- 'so###mviver.com':443
- 'localhost':49276
- 'localhost':49329
- 'localhost':49206
- 'bm###ybar.com':443
- 'localhost':49236
- 'b2####lition.com':443
- 'be###niet.com':443
- 'bb###neco.com':443
- 'localhost':49294
- 'bd###acus.com':443
- 'localhost':49240
- 'sr###roduct.com':443
- 'ar####-amade.com':443
- 'as####fotech.com':443
- 'br#####servicesllc.com':443
- 'as####munity.com':443
- 'an####eorban.com':443
- 'as###humi.com':443
- 'localhost':49368
- 'localhost':49254
- 'localhost':49362
- 'localhost':49356
- 'ba###s184.com':443
- 'localhost':49350
- 'ss###raders.com':443
- 'as###ajit.com':443
- 'au####ysk-pl.com':443
- 'ba###s435.com':443
- 're###tcha.cloud':443
- 'ba###aius.com':443
- 'localhost':49246
- 'ay####coffee.com':443
- 'localhost':49347
- 'ar####eideas.com':443
- 'localhost':49204
- 'aq####ave-tr.com':443
- 'localhost':49285
- 'localhost':49210
- 'localhost':49200
- 'an####uplink.com':443
- 'ba####zerian.com':443
- 'localhost':49264
- 'localhost':49208
- 'localhost':49260
- 'ap####ru-seo.com':443
- 'localhost':49278
- 'localhost':49274
- 'localhost':49286
- 'localhost':49218
- 'localhost':49288
- 'localhost':49296
- 'localhost':49202
- 'localhost':49262
- 'localhost':49228
- 'localhost':49258
- 'localhost':49298
- 'localhost':49244
- 'localhost':49224
- 'localhost':49290
- 'localhost':49256
- 'localhost':49242
- 'localhost':49222
- 'localhost':49248
- 'localhost':49198
- 'localhost':49196
- 'localhost':20544
- '66.#06.0.82':9001
- '85.##0.227.103':443
- 'localhost':49214
- 'va######nsportnature.com':443
- 'as####olcano.com':443
- 'localhost':49238
- 'bo###upnj.com':443
- 'localhost':49280
- 'localhost':49270
- 'ax####velops.com':443
- 'ap####vip-br.com':443
- 'ar####ptions.com':443
- 'an####oradio.com':443
- 'ap####top-br.com':443
- 'localhost':49232
- 'an####erdomo.com':443
- 'bu###dudu.com':443
- 'localhost':49216
- 'localhost':49220
- 'localhost':49212
- 'localhost':49234
- 'aw####alazel.com':443
- 'ap####esclub.com':443
- 'localhost':49268
- 'localhost':49282
- 'localhost':49250
- 'localhost':49292
- 'localhost':49226
- 'localhost':49266
- 'localhost':49366
- DNS ASK se####ation17io.io
- DNS ASK ba###s184.com
- DNS ASK as####edward.com
- DNS ASK br#####servicesllc.com
- DNS ASK as####-buyer.com
- DNS ASK sr###roduct.com
- DNS ASK au####ysk-pl.com
- DNS ASK va######nsportnature.com
- DNS ASK as###humi.com
- DNS ASK an####esifre.com
- DNS ASK br###luxe.com
- DNS ASK ay####coffee.com
- DNS ASK ax####velops.com
- DNS ASK bb###neco.com
- DNS ASK ar####-amade.com
- DNS ASK at###noir.com
- DNS ASK an####erdomo.com
- DNS ASK ba####zerian.com
- DNS ASK as###ajit.com
- DNS ASK re###tcha.cloud
- DNS ASK sa###mi-sp.com
- DNS ASK ba####magico.com
- DNS ASK ba####banhan.com
- DNS ASK ba####zuriel.com
- DNS ASK be####amille.com
- DNS ASK be####bet-br.com
- DNS ASK be####santai.com
- DNS ASK be####pro-br.com
- DNS ASK bi####ionusa.com
- DNS ASK al####rminum.com
- DNS ASK an####oradio.com
- DNS ASK ar####eideas.com
- DNS ASK bo###upnj.com
- DNS ASK ar####sagora.com
- DNS ASK tr##c.com
- DNS ASK ba###aius.com
- DNS ASK bd###acus.com
- DNS ASK be###niet.com
- DNS ASK ap####esclub.com
- DNS ASK bm###ybar.com
- DNS ASK ap####top-br.com
- DNS ASK bu###dudu.com
- DNS ASK ap####vip-br.com
- DNS ASK ss###raders.com
- DNS ASK ap####ru-seo.com
- DNS ASK al####dallas.com
- DNS ASK ar####ptions.com
- DNS ASK bl####tjoins.com
- DNS ASK so###mviver.com
- DNS ASK an####eorban.com
- DNS ASK as####munity.com
- DNS ASK as####olcano.com
- DNS ASK an####uplink.com
- DNS ASK au####liamod.com
- DNS ASK aw####alazel.com
- DNS ASK b2####lition.com
- DNS ASK ap####max-br.com
- DNS ASK be###ours.com
- DNS ASK ap####win-br.com
- DNS ASK ba####g-stay.com
- DNS ASK un###quotes.com
- DNS ASK ba###s435.com
- DNS ASK aq####ave-tr.com
- DNS ASK jo##.bestsup.su
- DNS ASK as####fotech.com
- DNS ASK bl####9music.com
- ClassName: '' WindowName: 'Xd5431_Flash2253FixClass_Xd5431'
- '%TEMP%\425.exe'
- '%TEMP%\31db.exe'
- '%TEMP%\is-3cbp8.tmp\31db.tmp' /SL5="$F0242,2376314,54272,%TEMP%\31DB.exe"
- '%TEMP%\4e32.exe'
- '%TEMP%\676d.exe'
- '%TEMP%\7f80.exe'
- '%LOCALAPPDATA%\menu\menu.exe' -i
- '%LOCALAPPDATA%\menu\menu.exe' -s
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\29BF.dll