I see related Google results for 'rpcnet.exe'. Not sure if they are related yet (spelling error?).
Also, I wonder how quickly they could rename the executable to deter removal, given the nature of their 'Persistence Module' and antivirus industry cooperation.
