Technical Information
- <SYSTEM32>\attrib.exe
- 'po##.####troneum.hashvault.pro':3333
- DNS ASK po##.####troneum.hashvault.pro
- '<SYSTEM32>\attrib.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn \Windows\Recovery\Cleaner /tr "C:\ProgramData\Iostream.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f