Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NexonPlayer' = '%APPDATA%\NexonPlayer\NexonPlayer.exe'
- %APPDATA%\nexonplayer\nexonplayer.exe
- 'be#######r.chickenkiller.com':8153
- DNS ASK be#######r.chickenkiller.com
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'NexonPlayer';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'NexonPlay...