Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\adrclient.url
- %HOMEPATH%\adrclient\adrclient.vbs
- %HOMEPATH%\adrclient\cabapi.exe
- %APPDATA%\remcos\logs.dat
- %APPDATA%\remcos\logs.dat
- 'cl###war.com':2555
- 'cl#####r.duckdns.org':2555
- DNS ASK cl###war.com
- DNS ASK cl#####r.duckdns.org