Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.vbs
- %APPDATA%\<File name>.exe
- 'da######ess.crabdance.com':7179
- 'js###rling.com':80
- http://js###rling.com/wrcontent/loader/plugin/Plugin_1
- 'da######ess.crabdance.com':7179
- DNS ASK da######ess.crabdance.com
- DNS ASK js###rling.com