Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\rtlupd64.url
- %HOMEPATH%\rtlupd64\rtlupd64.vbs
- %HOMEPATH%\rtlupd64\changepk.exe
- %APPDATA%\remcos\logs.dat
- 'ma#######4.chickenkiller.com':9003
- DNS ASK ma#######4.chickenkiller.com