Technical Information
- [HKLM\Software\Classes\exefile\shell\open\command] '' = '"<SYSTEM32>\q4JQMmpXGM.dll" "%1"'
- powershell.exe process, Amsi.dll module
- regsvr32.exe process, Amsi.dll module
- regsvr32.exe process, ntdll.dll module
- <SYSTEM32>\dll_log.txt
- <SYSTEM32>\q4jqmmpxgm.dll