Technical Information
- %TEMP%\nssa1bb.tmp\killprocdll.dll
- %TEMP%\nssa1bb.tmp\dllwaitforkillprogram.dll
- %APPDATA%\microadpop\microadpop.exe
- %APPDATA%\microadpop\microadpopagent.exe
- %TEMP%\nssa1bb.tmp\dllwebcount.dll
- %TEMP%\nssa1bb.tmp\selfdelete.dll
- C:\delus.bat
- %TEMP%\nssa1bb.tmp\dllwaitforkillprogram.dll
- %TEMP%\nssa1bb.tmp\dllwebcount.dll
- %TEMP%\nssa1bb.tmp\killprocdll.dll
- %TEMP%\nssa1bb.tmp\selfdelete.dll
- DNS ASK tr#.###roadpop.co.kr
- '%APPDATA%\microadpop\microadpop.exe'
- '%WINDIR%\syswow64\cmd.exe' /c \DelUS.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c \DelUS.bat