Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\ncwtdprd.lnk
- 'cd#.##scordapp.com':443
- '10#.#06.241.81':80
- '<LOCALNET>.9.42':1604
- 'xe###.ddns.net':1604
- http://10#.#06.241.81/htdocs/RdSwQ.exe
- 'cd#.##scordapp.com':443
- DNS ASK cd#.##scordapp.com
- DNS ASK xe###.ddns.net