A Konni-linked Windows shortcut sample named ECRM.M.M.hwp.lnk uses mshta.exe to build and run an obfuscated PowerShell command. The script searches for an LNK file of exactly 0x17cb bytes, falls back to the user's TEMP subdirectories if needed, skips the first 0x8e4 bytes, writes the remaining embedded payload to e.ps1, and executes it with PowerShell policy-bypass behavior. The analysis identifies the sample hashes and a reversed or encoded IP artifact that resolves to 46.20.95.148, giving defenders concrete hunting material for related Konni LNK activity.