Technical Information
- '%TEMP%\kilf1.exe'
- '%TEMP%\budha.exe'
- '%TEMP%\kilf1.exe' (downloaded from the Internet)
- %TEMP%\kilf1.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\al2901[1].enc
- %TEMP%\budha.exe
- 'fo##4u.pk':80
- fo##4u.pk/img/al2901.enc
- DNS ASK fo##4u.pk