Technical Information
- %APPDATA%\MZђ
- %APPDATA%\MZђ (downloaded from the Internet)
- %WINDIR%\sleep.exe 5
- <SYSTEM32>\cmd.exe /c ""<Current directory>\123.bat" "
- <Current directory>\123.bat
- %APPDATA%\MZђ
- 'we##ide.kr':80
- we##ide.kr/link/rand/runexe4.php
- DNS ASK we##ide.kr
- ClassName: 'MS_WINHELP' WindowName: ''