Technical Information
- [<HKLM>\System\CurrentControlSet\Services\perfproc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\perfproc] 'ImagePath' = '"%WINDIR%\SysWOW64\dsdmo\perfproc.exe"'
- 'perfproc' "%WINDIR%\SysWOW64\dsdmo\perfproc.exe"
- 'perfproc' %WINDIR%\SysWOW64\dsdmo\perfproc.exe
- from <Full path to file> to %WINDIR%\syswow64\dsdmo\perfproc.exe
- '2.##.176.233':80
- '98.##3.204.12':443
- http://98.###.204.12:443/P573IFJhZPmxD/FNhSIOGXe0Vmpymfy5G/BaIO4eJ/Lvr1vLAsgASgGjmrW/ via 98.##3.204.12