Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dsnaclmqvkwbmcecqnho' = 'C:\Users\Public\dsnaclmqvkwbmcecqnho.vbs'
- pdf.exe
- C:\appdata\local\temp\shrpubw\licensemanagershellext.bat
- %APPDATA%\pdf.exe
- '21#.#08.152.210':8181
- '%APPDATA%\pdf.exe'