Technical Information
- [<HKLM>\Software\Classes\nopspro.cmd\shell\open\command] '' = '"<Current directory>\TmsDeployManager.exe" "%1"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file> _AUTORUN_'
- <PATH_SAMPLE>\logfiles\2023-02-26.log
- 're###.nops.co.kr':8000
- http://re###.#ops.co.kr:8000/nops.ipinfo?lo############################################## via re###.nops.co.kr
- DNS ASK re###.nops.co.kr