Technical Information
- %TEMP%\~nsu.tmp\au_.exe
- %TEMP%\nsnd960.tmp\killprocdll.dll
- %TEMP%\nsnd960.tmp\dllwaitforkillprogram.dll
- %TEMP%\nsnd960.tmp\getversion.dll
- %TEMP%\nsnd960.tmp\nsexec.dll
- %TEMP%\nsnd960.tmp\dllwebcount.dll
- DNS ASK op####yword.co.kr
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- '%TEMP%\~nsu.tmp\au_.exe' _?=<Current directory>\
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn OKSTART /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn OKSTART /F