Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\amwa.com.url
- %APPDATA%\microsoft\windows\start menu\programs\startup\client.exe
- hidden files
- %WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe
- %APPDATA%\result\direction.exe
- %TEMP%\aut3f6c.tmp
- <LS_APPDATA>\tempakdqo.bmp
- %APPDATA%\result\direction.exe
- %TEMP%\aut3f6c.tmp
- DNS ASK do#####2019.duckdns.org
- '%WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe'