Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Anti-Malware' = '"%APPDATA%/Performance/dlhosta.exe"'
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite-shm
- %APPDATA%\Performance\dlhosta.exe
- %APPDATA%\147.exe
- %APPDATA%\HDAudio.exe
- %APPDATA%\Performance\dlhosta.exe
- 'kr##ns.pw':80
- http://kr##ns.pw/up_d.php
- DNS ASK kr##ns.pw
- ClassName: 'EDIT' WindowName: ''
- '%APPDATA%\HDAudio.exe'
- '%APPDATA%\147.exe'